GHSA-9759-3276-g2pm
Cube API denial of service attack
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| npm | @cubejs-backend/api-gateway | < 0.34.34 | 0.34.34 |
Details
As written in the advisory (Markdown source, shown as plain text).
### Impact
It is possible to make the entire Cube API unavailable by submitting a specially crafted request to a Cube API endpoint.
### Patches
The issue has been patched in the `v0.34.34` and it's recommended that all users exposing Cube APIs to the public internet upgrade to the latest version to prevent service disruption.
### Workarounds
There are currently no workaround for older versions, and the recommendation is to upgrade.
### References
The issue was reported by [y0d3n](https://github.com/y0d3n) in our Community Slack and has been promptly patched in the recent update.
References
External links from the advisory. They lead to third-party sites.