CVE-2026-74837: Unbounded atom creation from client-supplied RPC field names in AshTypescript field formatter
Allocation of Resources Without Limits or Throttling vulnerability in ash-project ashtypescript allows an unauthenticated attacker to exhaust the BEAM atom table and abort the node via client-supplied RPC field names.
AshTypescript.FieldFormatter.converttofieldatom/2 in lib/ashtypescript/fieldformatter.ex converts a client-supplied field name to an atom with String.toatom/1 when no matching atom already exists. It delegates first to parseinputfield/2, which resolves the name with String.toexistingatom/1 and falls back to returning the plain string; converttofieldatom/2 then mints an atom from that string rather than treating the name as unknown.
RPC field selection reaches it for every requested field name through AshTypescript.Rpc.FieldProcessing.FieldSelector, which resolves each name before checking that the field exists, with no allowlist, length bound, or rate limit. Atoms are never garbage collected, so each distinct name mints a permanent one and the VM aborts once the atom table limit is reached. A field name over 255 characters additionally raises an uncaught SystemLimitError.
This issue affects ashtypescript: from 0.1.0 before 0.18.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ash-project ash_typescriptto a version that resolves this vulnerability.Fixed in 0.18.0 - Compensating control
Apply a compensating control by blocking or rate-limiting unauthenticated access to AshTypescript RPC field selection (e.g., via network controls/firewall/WAF or an application-layer throttle) to prevent attackers from repeatedly supplying distinct RPC field names that would exhaust the BEAM atom table.
Event History
Frequently Asked Questions
Who is exposed to this issue?
Deployments using ash_typescript versions from 0.1.0 before 0.18.0 are affected where an unauthenticated client can submit RPC field selections. The vulnerable path processes every requested field name before verifying that the field exists.
What does an attacker need to exploit it?
An attacker only needs to supply distinct field names through the RPC field-selection mechanism; no authentication is required. Each previously unseen name can create a permanent BEAM atom, eventually exhausting the atom table and aborting the node.
Are invalid field names safe from this behavior?
No. Unknown names fall back to strings and are then converted with String.to_atom/1 rather than being rejected before atom creation. A supplied field name longer than 255 characters can also trigger an uncaught SystemLimitError.
What can be done if upgrading is not immediately possible?
The provided data identifies no built-in allowlist, length bound, or rate limit in the affected field-selection path. Reduce or prevent unauthenticated access to RPC field selection and reject unrecognized or oversized field names before they reach AshTypescript.
How can operators recognize exploitation or impact?
Impact manifests as persistent growth in BEAM atoms from distinct requested field names, followed by node abortion when the atom-table limit is reached. Requests containing field names over 255 characters may instead produce an uncaught SystemLimitError.