CVE-2026-25957: Denial of Service Vulnerability in @cubejs-backend/server-core
Summary
CVE-2026-25957: Cube Core is vulnerable to Denial of Service (DoS) via crafted request. Affects @cubejs-backend/server-core across 2 version ranges.
>= 1.1.17, < 1.4.2
>= 1.5.0, < 1.5.13
Fixed in 1.4.2 or 1.5.13, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The @cubejs-backend/server-core package is a core component of the Cube.js framework, which is designed for building powerful analytical applications. It provides a robust API for querying data and is widely used in data-driven applications. However, certain versions of this package are vulnerable to a Denial of Service (DoS) attack, which can render the Cube API unavailable.
Vulnerability Detail
The vulnerability arises from the ability to submit specially crafted requests to Cube API endpoints. This can lead to a situation where the API becomes unresponsive, impacting all users and applications relying on it. The issue was reported by a core engineer and has been classified under CWE-755, indicating a potential for service disruption. The affected versions are 1.1.17 and later, with specific fixes available in versions 1.4.2 and 1.5.13.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 1.1.17, < 1.4.21.4.2npm install @cubejs-backend/server-core@1.4.2 -
>= 1.5.0, < 1.5.131.5.13npm install @cubejs-backend/server-core@1.5.13
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability other than upgrading to the patched versions.
Conclusion
In summary, the @cubejs-backend/server-core package has a critical Denial of Service vulnerability that can be exploited through crafted requests. Users are urged to upgrade to the latest patched versions to safeguard their applications. Regular monitoring and vulnerability management practices, such as using tools like Vulert, can help maintain application security.
See every vulnerability recorded for @cubejs-backend/server-core →
FAQ
The vulnerability allows for Denial of Service (DoS) attacks through specially crafted requests to the Cube API.
Versions 1.1.17 and later of the @cubejs-backend/server-core package are affected.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without any signup.
The CVSS score of this vulnerability is 6.5, indicating a moderate severity level.
While there are no specific workarounds, it is recommended to monitor your application closely and plan for an upgrade as soon as possible.
References
Related vulnerabilities
Recent vulnerabilities recorded for @cubejs-backend/server-core.
