GHSA-9vph-2hvm-x66gMediumCVSS 6.5

Cube Core is vulnerable to Denial of Service (DoS) via crafted request

Published
February 10, 2026
Last Modified
February 10, 2026

🔗 CVE IDs covered (1)

CVE-2026-25957 →

📋 Description

Impact

It is possible to make the entire Cube API unavailable by submitting a specially crafted request to a Cube API endpoint.

Affected Versions:

>= 1.1.17

Mitigation:

Upgrade to a patched version:

  • 1.5.13 and later (regular release)
  • 1.4.2 (active LTS release)

References

The issue was reported by our Core engineer, Dmitrii Patsura (@ovr), in our internal Slack and was promptly patched in a recent update.

🎯 Affected products2

  • npm/@cubejs-backend/server-core:>= 1.1.17, < 1.4.2
  • npm/@cubejs-backend/server-core:>= 1.5.0, < 1.5.13

🔗 References (3)