CVE-2026-77950: AshTypescript RPC Error Handler Vulnerability Exposes Sensitive Information
Summary
CVE-2026-77950: RPC error handler fails open in AshTypescript, disclosing unredacted errors. Affects ash_typescript across 2 version ranges.
>= 0.8.0, < 0.18.0
>= cb01cc8749e5a2a17fb45aedbe75df30a9f1126e, < 59d8e985a98cf2e01794dbe5b919b897a95311f4
Fixed in 0.18.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
AshTypescript is a library designed to facilitate the integration of Ash Framework with TypeScript applications. It provides a robust RPC (Remote Procedure Call) endpoint over HTTP, allowing developers to build applications that can communicate with backend services seamlessly. However, a recent vulnerability has been identified that compromises the security of error handling within this library, potentially exposing sensitive internal error data to unauthorized users.
Vulnerability Detail
The vulnerability arises from the error handling mechanism in AshTypescript, specifically in the apply_error_handler function. When an error occurs, the configured error handler is expected to redact or suppress sensitive information before it is sent to the client. However, if an error shape does not match the expected patterns, a FunctionClauseError is raised, causing the original error, which may contain sensitive information, to be returned to the client. This flaw allows unauthenticated attackers to receive unredacted internal error data, posing a significant security risk.
How To Fix
Latest published version: 0.19.2 as of 22 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
0.18.0
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, developers can implement additional checks in their error handling logic to ensure that only expected error shapes are processed. For example, you can modify the error handler to log unexpected errors without returning them to the client. Here is a sample code snippet:
def apply_error_handler(error) do
case error do
expected_shape ->
# Handle expected error shapes
_ ->
Logger.warn("Unexpected error shape: #{inspect(error)}")
nil # Suppress the error
end
end
Conclusion
The CVE-2026-77950 vulnerability in AshTypescript poses a significant risk by allowing unauthorized access to sensitive error information. It is crucial for developers using this library to update to the latest version to mitigate this risk and ensure the security of their applications.
See every vulnerability recorded for ash_typescript →
FAQ
CVE-2026-77950 is a vulnerability in the AshTypescript library that allows unauthenticated attackers to receive unredacted internal error data.
If your application uses AshTypescript and is configured with a custom error handler, it may inadvertently expose sensitive information through error messages.
The vulnerability affects AshTypescript versions from 0.8.0 up to, but not including, 0.18.0.
You can use the Vulert platform to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected without any signup.
If an immediate update is not possible, implement a temporary workaround by enhancing your error handling logic to suppress unexpected error shapes.
Related vulnerabilities
Recent vulnerabilities recorded for ash_typescript.
