In ash-typescript, the function convert_to_field_atom/2 translates client‑supplied field names into atoms without any upper bound, allowing unlimited atom table growth. Because atoms are never garbage collected, each distinct name permanently uses an entry; once the BEAM atom table limit is reached the virtual machine aborts. A field name longer than 255 characters also triggers an uncaught SystemLimitError, further destabilizing the system. This weakness corresponds to CWE‑770.

The vulnerability is present in the ash‑project ash_typescript library for all releases from version 0.1.0 up to, but not including, version 0.18.0. Clients that connect to the RPC interface without authentication can trigger the atom creation logic through the FieldSelector path, which processes every requested field name without length checks or allowlists.

The CVSS score of 8.7 indicates high severity. Although EPSS data is unavailable and the issue is not listed in KEV, the absence of authentication and lack of rate limits make exploitation straightforward. An attacker can send many distinct or very long field names to the RPC endpoint, rapidly exhaust the atom table, and cause the node to crash, potentially impacting all services running on the Erlang VM.