CVE-2026-90582 evanchiu serverless-todo API Todo Endpoint index.js saveTodos resource consumption
Remote attackers can cause resource consumption and denial of service in the serverless-todo API via the saveTodos endpoint.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-90582?
CVE-2026-90582 is a medium-severity denial of service vulnerability in evanchiu serverless-todo, published on 13 Sep 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
A vulnerability was identified in evanchiu serverless-todo 1.0.3/2.0.0. Impacted is the function saveTodos of the file src/index.js of the component API Todo Endpoint. Such manipulation of the argument event.body leads to resource consumption. The attack can be executed remotely. The exploit is publicly available and might be used. The project was informed of the problem early through an issue report but has not responded yet.
Which versions are affected by CVE-2026-90582?
How do I fix CVE-2026-90582?
No fix has been published for CVE-2026-90582 yet. Limit exposure of the affected software until one is available.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-90582 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-90582 exists.
Sources
Also known as GHSA-4h8c-6gfp-w4fg.