CVE-2026-74837

CVE-2026-74837 is an unauthenticated resource-exhaustion vulnerability (CWE-770) in the ash_typescript Elixir package that lets a remote attacker exhaust the BEAM atom table and abort the entire VM node, producing a high-availability-impact denial of service (CVSS 4.0 8.7) with no confidentiality or integrity impact. The flaw is reached through AshTypescript.Rpc.FieldProcessing.FieldSelector, which resolves every client-supplied RPC field name before checking that the field exists, after which AshTypescript.FieldFormatter.convert_to_field_atom/2 mints a new atom via String.to_atom/1 when none exists, with no allowlist, length bound, or rate limit; because BEAM atoms are never garbage collected, an attacker can submit large numbers of unique field names to permanently consume the atom table until the node aborts. A single field name longer than 255 characters additionally raises an uncaught SystemLimitError, providing a second failure path. Any application using ash_typescript from 0.1.0 before 0.18.0 to expose its RPC layer is affected, and unauthenticated endpoints are directly reachable per the CVSS vector (no privileges or user interaction required). No public proof of concept is known, the issue is not in CISA KEV, and EPSS estimates only a 0.3% probability of exploitation within 30 days, so no exploitation has been reported.

What to do: Upgrade ash_typescript to 0.18.0 or later. As interim mitigation, validate or allowlist RPC field names, cap field-name length below 255 characters, and rate-limit or require authentication on the RPC endpoint, while monitoring BEAM atom table usage (e.g., :erlang.system_info(:atom_count)) for abnormal growth. Teams should confirm whether their application exposes the ash_typescript RPC controller to unauthenticated internet traffic.