CVE-2026-77856

Versions of the ash_typescript package from 0.11.0 before 0.18.0 fail to limit or throttle resource allocation when resolving client-supplied typed struct field names, allowing an unauthenticated attacker to exhaust the BEAM atom table and abort the node. The flaw is in resolve_typed_struct_field/2 (lib/ash_typescript/rpc/field_processing/field_selector.ex): when a supplied field name is not found in the typed struct's reverse map, the code falls back to String.to_atom/1 before any field-existence check, minting a permanent atom for every unresolvable name. Because atoms are never garbage collected, requests carrying many distinct names grow the atom table until the VM aborts at its limit, so the impact is a high-severity denial of service (no confidentiality or integrity impact). Any application running an affected ash_typescript version and exposing its RPC field-processing path to unauthenticated clients is affected. Exploitation is not currently observed: there is no known public proof of concept, the flaw is not in CISA KEV, and EPSS estimates only a 0.3% chance of exploitation in the next 30 days.

What to do: Upgrade ash_typescript to 0.18.0 or later, which stops minting atoms for unresolvable field names. If upgrading is not immediately possible, restrict or validate client-supplied typed struct field names, monitor BEAM atom table usage, and be prepared to restart affected nodes, noting that raising the atom limit only delays the abort. Review whether any applications running ash_typescript 0.11.0 through 0.17.x expose the RPC field-processing path to unauthenticated users.