Unleash enables an unauthenticated attacker to send a large, deeply nested JSON payload to any OpenAPI‑validated endpoint, such as POST /edge/validate or POST /edge/issue-token. The shared error formatter passes the raw request value from lodash.get directly to JSON.stringify without guarding against stack exhaustion. The resulting call stack overflow triggers a RangeError and crashes the Node process because no uncaughtException handler recovers it, producing a complete service outage that can be sustained by replaying the request.

The vulnerability affects the Unleash feature‑management platform prior to releases v7.5.2, v7.6.5, and v8.0.2. An affected instance can be any Unleash deployment using those older versions, regardless of authentication settings.

The flaw carries a CVSS score of 7.5, indicating high severity. This flaw is a classic example of CWE‑674, where unchecked recursion leads to stack exhaustion. No EPSS data is available and the vulnerability is not listed in CISA’s KEV catalog. The likely attack vector is unauthenticated network access to the OpenAPI endpoints, which requires only that the attacker can craft a deeply nested JSON payload. Given the simplicity of the exploit and the lack of mitigation on the application side, the risk of widespread exploitation is high and can lead to sustained denial‑of‑service outages.