Cube Core is vulnerable to Denial of Service (DoS) via crafted request

TRUNG BÌNH 6.5CVE-2026-25957 · GHSA-9vph-2hvm-x66g · Công bố 09/02/2026 · cập nhật 17/06/2026

Tóm tắt nhanh

CVE-2026-25957 là lỗ hổng mức TRUNG BÌNH (CVSS 6.5) ảnh hưởng cube.js (cube), @cubejs-backend/server-core.
Xác suất bị khai thác trong 30 ngày tới (EPSS): 0.43%, cao hơn 37.9% các lỗ hổng khác.
Cách xử lý: cập nhật lên 1.4.2, 1.5.13 hoặc mới hơn.

Gói / sản phẩm	Phiên bản bị ảnh hưởng	Phiên bản đã vá
cube.js cube	`≥ 1.1.17, < 1.4.2≥ 1.5.0, < 1.5.13`	`1.4.21.5.13`
@cubejs-backend/server-core npm	`≥ 1.1.17, < 1.4.2≥ 1.5.0, < 1.5.13`	`1.4.21.5.13`

Mô tả

Impact

It is possible to make the entire Cube API unavailable by submitting a specially crafted request to a Cube API endpoint.

Affected Versions:

>= 1.1.17

Mitigation:

Upgrade to a patched version:

1.5.13 and later (regular release)
1.4.2 (active LTS release)

References

The issue was reported by our Core engineer, Dmitrii Patsura (@ovr), in our internal Slack and was promptly patched in a recent update.

Mô tả của NVD

Cube is a semantic layer for building data applications. From 1.1.17 to before 1.5.13 and 1.4.2, it is possible to make the entire Cube API unavailable by submitting a specially crafted request to a Cube API endpoint. This vulnerability is fixed in 1.5.13 and 1.4.2.