CVE-2026-77856: Unbounded atom creation from typed struct field names in AshTypescript field selector
Allocation of Resources Without Limits or Throttling vulnerability in ash-project ashtypescript allows an unauthenticated attacker to exhaust the BEAM atom table and abort the node via client-supplied typed struct field names.
resolvetypedstructfield/2 in lib/ashtypescript/rpc/fieldprocessing/fieldselector.ex looks a client-supplied field name up in the typed struct's reverse map and, when it finds no match, falls back to String.toatom/1. Because this runs before any field-existence check, an unresolvable name mints a permanent atom rather than being rejected as unknown. Atoms are never garbage collected, so a request carrying many distinct names on a typed struct field grows the atom table until the VM aborts at its limit.
This issue affects ashtypescript: from 0.11.0 before 0.18.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ash-project/ash_typescriptto a version that resolves this vulnerability.Fixed in 0.18.0 - Compensating control
Mitigate by preventing unauthenticated clients from invoking AshTypescript RPC endpoints that call resolve_typed_struct_field/2 (e.g., require authentication and apply access control so only trusted clients can submit typed struct field names).
Event History
Frequently Asked Questions
Who can exploit this issue?
An unauthenticated attacker can exploit it by supplying typed struct field names to the affected field selector. They do not need to provide valid field names; distinct unresolvable names trigger creation of permanent BEAM atoms.
Which versions are affected?
ash_typescript versions from 0.11.0 up to, but not including, 0.18.0 are affected.
What is the practical impact of a successful attack?
Repeated requests with many distinct invalid typed struct field names can exhaust the BEAM atom table. Once the VM reaches its atom limit, the node aborts.
How can I determine whether an attempted attack may have occurred?
Look for requests containing large numbers of distinct, unknown field names targeting typed struct fields. The vulnerable code creates an atom for each unresolved name before checking whether that field exists.