Cube Core is vulnerable to Denial of Service (DoS) via crafted request

中 6.5CVE-2026-25957 · GHSA-9vph-2hvm-x66g · 09/02/2026 公開 · 17/06/2026 更新

要点

CVE-2026-25957 は cube.js (cube), @cubejs-backend/server-core に影響する深刻度「中」 (CVSS 6.5) の脆弱性です。
今後30日間に悪用される確率（EPSS）：0.43%（全脆弱性の 37.9% より高い）。
対処：1.4.2, 1.5.13 以降に更新してください。

パッケージ	影響を受けるバージョン	修正済みバージョン
cube.js cube	`≥ 1.1.17, < 1.4.2≥ 1.5.0, < 1.5.13`	`1.4.21.5.13`
@cubejs-backend/server-core npm	`≥ 1.1.17, < 1.4.2≥ 1.5.0, < 1.5.13`	`1.4.21.5.13`

概要

Impact

It is possible to make the entire Cube API unavailable by submitting a specially crafted request to a Cube API endpoint.

Affected Versions:

>= 1.1.17

Mitigation:

Upgrade to a patched version:

1.5.13 and later (regular release)
1.4.2 (active LTS release)

References

The issue was reported by our Core engineer, Dmitrii Patsura (@ovr), in our internal Slack and was promptly patched in a recent update.

NVD の説明

Cube is a semantic layer for building data applications. From 1.1.17 to before 1.5.13 and 1.4.2, it is possible to make the entire Cube API unavailable by submitting a specially crafted request to a Cube API endpoint. This vulnerability is fixed in 1.5.13 and 1.4.2.