CVE-2026-63466

Unleash (open-source feature management platform) is affected by a global Mustache.escape override in versions prior to 8.0.3 . The FeatureEventFormatterMd.format function in feature-event-formatter-md.ts assigns Mustache.escape to an identity function before rendering templates. Because this ass...

CVE-2026-63462

Unleash , an open-source feature management platform, is vulnerable to an unauthenticated denial-of-service in versions prior to 7.5.2, 7.6.5, and 8.0.2 . The root cause is in the shared OpenAPI validation error path (src/lib/error/bad-data-error.ts), which passes a raw request value from lodash....

CVE-2026-63462 Unleash: Unauthenticated single-request DoS via OpenAPI validation error formatter

Unleash is an open-source feature management platform. Prior to 7.5.2, 7.6.5, and 8.0.2, the shared OpenAPI validation error path in src/lib/error/bad-data-error.ts passes a raw request value from lodash.get to JSON.stringify in genericErrorMessage and fromOpenApiValidationErrors without guarding...

CVE-2026-63462 Unleash: Unauthenticated single-request DoS via OpenAPI validation error formatter

Unleash is an open-source feature management platform. Prior to 7.5.2, 7.6.5, and 8.0.2, the shared OpenAPI validation error path in src/lib/error/bad-data-error.ts passes a raw request value from lodash.get to JSON.stringify in genericErrorMessage and fromOpenApiValidationErrors without guarding...

CVE-2026-63462 Unleash: Unauthenticated single-request DoS via OpenAPI validation error formatter

Unleash is an open-source feature management platform. Prior to 7.5.2, 7.6.5, and 8.0.2, the shared OpenAPI validation error path in src/lib/error/bad-data-error.ts passes a raw request value from lodash.get to JSON.stringify in genericErrorMessage and fromOpenApiValidationErrors without guarding...

EUVD-2026-64041

Unleash is an open-source feature management platform. Prior to 7.5.2, 7.6.5, and 8.0.2, the shared OpenAPI validation error path in src/lib/error/bad-data-error.ts passes a raw request value from lodash.get to JSON.stringify in genericErrorMessage and fromOpenApiValidationErrors without guarding...

EUVD-2026-64040

Unleash is an open-source feature management platform. Prior to 7.5.2, 7.6.5, and 8.0.2, the addon and integration subsystem passes the operator-controlled parameters.url value from src/lib/addons/webhook.ts and the Slack, Microsoft Teams, Datadog, and New Relic integrations to Addon.fetchRetry i...

CVE-2026-63004

Unleash , an open-source feature management platform, is vulnerable to Server-Side Request Forgery (SSRF) in its addon and integration subsystem. The operator-controlled parameters.url value from src/lib/addons/webhook.ts and the Slack, Microsoft Teams, Datadog, and New Relic integrations is pass...

CVE-2026-63004 Unleash: Addon webhook URL is dialed server-side with no internal-address filtering, enabling SSRF to internal services / cloud metadata and exfiltration of configured request headers

Unleash is an open-source feature management platform. Prior to 7.5.2, 7.6.5, and 8.0.2, the addon and integration subsystem passes the operator-controlled parameters.url value from src/lib/addons/webhook.ts and the Slack, Microsoft Teams, Datadog, and New Relic integrations to Addon.fetchRetry i...

CVE-2026-63004 Unleash: Addon webhook URL is dialed server-side with no internal-address filtering, enabling SSRF to internal services / cloud metadata and exfiltration of configured request headers

Unleash is an open-source feature management platform. Prior to 7.5.2, 7.6.5, and 8.0.2, the addon and integration subsystem passes the operator-controlled parameters.url value from src/lib/addons/webhook.ts and the Slack, Microsoft Teams, Datadog, and New Relic integrations to Addon.fetchRetry i...

CVE-2026-63004 Unleash: Addon webhook URL is dialed server-side with no internal-address filtering, enabling SSRF to internal services / cloud metadata and exfiltration of configured request headers

Unleash is an open-source feature management platform. Prior to 7.5.2, 7.6.5, and 8.0.2, the addon and integration subsystem passes the operator-controlled parameters.url value from src/lib/addons/webhook.ts and the Slack, Microsoft Teams, Datadog, and New Relic integrations to Addon.fetchRetry i...

PT-2026-79422

Name of the Vulnerable Software and Affected Versions Unleash versions prior to 7.5.2 Unleash versions prior to 7.6.5 Unleash versions prior to 8.0.2 Description An unauthenticated attacker can cause a complete service outage by sending a deeply nested JSON value approximately 10 KB to...

CVE-2026-63462: Uncontrolled Recursion

Unleash is an open-source feature management platform. Prior to 7.5.2, 7.6.5, and 8.0.2, the shared OpenAPI validation error path in src/lib/error/bad-data-error.ts passes a raw request value from lodash.get to JSON.stringify in genericErrorMessage and fromOpenApiValidationErrors without guarding...

PT-2026-79430

Unleash is an open-source feature management platform. Prior to 8.0.3, FeatureEventFormatterMd.format in src/lib/addons/feature-event-formatter-md.ts assigns Mustache.escape to an identity function before rendering action and path templates. Because Mustache.escape is process-wide, the assignment...

CVE-2026-63004: Server-Side Request Forgery (SSRF)

Unleash is an open-source feature management platform. Prior to 7.5.2, 7.6.5, and 8.0.2, the addon and integration subsystem passes the operator-controlled parameters.url value from src/lib/addons/webhook.ts and the Slack, Microsoft Teams, Datadog, and New Relic integrations to Addon.fetchRetry i...

CVE-2026-63466: Improper Encoding or Escaping of Output

Unleash is an open-source feature management platform. Prior to 8.0.3, FeatureEventFormatterMd.format in src/lib/addons/feature-event-formatter-md.ts assigns Mustache.escape to an identity function before rendering action and path templates. Because Mustache.escape is process-wide, the assignment...

PT-2026-79421

Unleash is an open-source feature management platform. Prior to 7.5.2, 7.6.5, and 8.0.2, the addon and integration subsystem passes the operator-controlled parameters.url value from src/lib/addons/webhook.ts and the Slack, Microsoft Teams, Datadog, and New Relic integrations to Addon.fetchRetry i...

CVE-2026-73646 vulnerabilities

Vulnerabilities for packages: arangodb, unleash, librechat, langfuse-fips, vitess, cadence-web, jitsucom-jitsu, unleash-fips, authentik-fips, pelias-api, authentik, keep-fips, langfuse, homepage, nextcloud-server, semaphore, keep, gitlab-rails-ce-fips, gitlab-rails-ce...

CVE-2026-54272 vulnerabilities

Vulnerabilities for packages: opensearch-dashboards, kibana, unleash, renovate, librechat, langfuse-fips, pulumi, unleash-fips, lerna, npm, graalvm, langfuse, kubeflow-pipelines, sqlpad, wazuh-dashboard, wazuh-dashboard-fips, saf, unleash-proxy, actions-runner, opensearch-dashboards-fips,...

CVE-2026-69192 vulnerabilities

Vulnerabilities for packages: opensearch-dashboards, kibana, unleash, renovate, librechat, langfuse-fips, pulumi, unleash-fips, lerna, npm, graalvm, langfuse, kubeflow-pipelines, sqlpad, wazuh-dashboard, wazuh-dashboard-fips, saf, unleash-proxy, actions-runner, opensearch-dashboards-fips,...