A critical resource exhaustion vulnerability in ash_typescript allows unauthenticated attackers to cause a denial of service by crashing the underlying BEAM node.

The application utilizes String.to_atom/1 on user-supplied input within the FieldFormatter module without implementing length bounds or rate limits, allowing an unauthenticated attacker to exhaust the BEAM atom table. Because atoms in the BEAM virtual machine are not garbage collected, this leads to a node abort once the system limit is reached.

This vulnerability poses a significant risk to service availability, as it allows any unauthenticated network user to force a complete application crash. Given the CVSS score of 8.7, the potential for widespread service disruption is high, which could result in substantial operational downtime and loss of system integrity for any infrastructure relying on the affected library.

Immediate Action: Update the ash_typescript dependency to version 0.18.0 or later to ensure proper input handling and atom creation limits are enforced.

Proactive Monitoring: Review application logs for unusually high volumes of RPC requests or frequent node restarts that may indicate an attempt to trigger this exhaustion condition.

Compensating Controls: Implement strict rate limiting at the network or API gateway level to restrict the number of requests a single client can make, thereby reducing the velocity at which an attacker can exhaust the atom table.

Public Exploit Available: No — there is no confirmed public exploit in the available data.

The severity of this issue is underscored by the ease with which an unauthenticated actor can destabilize the entire application environment. Administrators must prioritize updating to version 0.18.0 to eliminate the underlying logic flaw. Failure to apply this update leaves the service vulnerable to simple and highly effective denial of service attacks.