MEDIUM

CVE-2026-90582

2026-09-13 CVSS v3.1

CVSS

5.3

Description

A vulnerability was identified in evanchiu serverless-todo 1.0.3/2.0.0. Impacted is the function saveTodos of the file src/index.js of the component API Todo Endpoint. Such manipulation of the argument event.body leads to resource consumption. The attack can be executed remotely. The exploit is publicly available and might be used. The project was informed of the problem early through an issue report but has not responded yet.

Weakness (CWE)

CWE-400 Uncontrolled Resource Consumption

CWE-404

EPSS Score

0.41%

Probability of exploitation in next 30 days

34.6th percentile

References

https://github.com/evanchiu/serverless-todo/ https://github.com/evanchiu/serverless-todo/issues/10 https://vuldb.com/cve/CVE-2026-90582 https://vuldb.com/submit/913598 https://vuldb.com/vuln/403167 https://vuldb.com/vuln/403167/cti

View on dbcve.org

Base CVE data derived from NVD (public domain). Enrichment by dbcve.org (CC-BY-4.0). Fetched via API.

Back to CVE