A critical resource exhaustion vulnerability in the ash_typescript library allows unauthenticated remote attackers to trigger a denial of service by causing the BEAM virtual machine to crash.

The flaw exists in the resolve_typed_struct_field/2 function, which incorrectly uses String.to_atom/1 on client-supplied data before validating field existence. Because atoms in the BEAM environment are not garbage collected, an unauthenticated attacker can force the creation of infinite permanent atoms until the node reaches its limit and aborts.

This vulnerability poses a significant risk to service availability, as it enables a trivial denial of service attack that does not require authentication. With a CVSS score of 8.2, the impact is high because a successful exploit results in a total crash of the affected application node, leading to potential business disruption and loss of service uptime for end users.

Immediate Action: Update the ash_typescript dependency to version 0.18.0 or later, which includes the necessary field existence checks to prevent unauthorized atom creation.

Proactive Monitoring: Monitor application logs for high volumes of unexpected or malformed RPC requests, and track BEAM atom table usage metrics to detect potential exhaustion attempts.

Compensating Controls: Implement rate limiting on all public-facing endpoints that process typed struct fields, and deploy a Web Application Firewall to filter out suspicious or excessively large payloads.

Public Exploit Available: No

Given the ease with which an unauthenticated attacker can crash the entire node, this vulnerability should be prioritized for immediate remediation. Organizations utilizing the ash_typescript library must update to the patched version as soon as possible to prevent potential service instability and denial of service incidents.