Resource Exhaustion Vulnerability in ash_typescript by Ash Project

CVE-2026-77856

What is CVE-2026-77856?

A resource exhaustion vulnerability has been identified in ash_typescript, allowing unauthenticated attackers to exhaust the BEAM atom table through unbounded client inputs. Specifically, the function resolve_typed_struct_field/2 does not implement proper checks before attempting to resolve typed struct field names. When a field name is unresolved, it falls back to String.to_atom/1, creating new atoms that accumulate indefinitely in the atom table. This leads to potential application crashes as the atom table reaches its limit, disrupting service and affecting system stability. It is imperative to patch versions prior to 0.18.0 to mitigate this risk.

References