CVE-2026-84856: rowboatlabs rowboat Composio Webhook Endpoint route.ts req.json denial of service
A vulnerability was detected in rowboatlabs rowboat up to 0.9.1. The impacted element is the function request.text/req.json of the file apps/rowboat/app/api/composio/webhook/route.ts of the component Composio Webhook Endpoint. The manipulation results in denial of service. It is possible to launch the attack remotely. The exploit is now public and may be used. Upgrading to version 0.9.2 is sufficient to resolve this issue. Upgrading the affected component is recommended. The legacy Next.js app was deleted at 0.9.2 rather than patched, leaving no security control behind.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
rowboatlabs rowboat Composio Webhook Endpoint (apps/rowboat/app/api/composio/webhook/route.ts)to a version that resolves this vulnerability.Fixed in 0.9.2
Event History
Frequently Asked Questions
Who is exposed to this issue?
Deployments of rowboatlabs rowboat through version 0.9.1 that include the legacy Next.js Composio Webhook Endpoint are affected. The issue can be exploited remotely.
What does an attacker need to exploit it?
No privileges or user interaction are required. The available information identifies request.text/req.json handling in the Composio webhook route as the affected functionality, and a public exploit is available.
Does upgrading remove the affected endpoint?
Yes. Version 0.9.2 resolves the issue by deleting the legacy Next.js application rather than patching the route, so the affected endpoint is no longer present.
How can I determine whether my deployment is affected?
Check the deployed rowboat version and whether it includes apps/rowboat/app/api/composio/webhook/route.ts in the legacy Next.js application. Versions up to 0.9.1 are affected; version 0.9.2 removes that application.