CVE-2026-84856

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-84856
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-84856.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-84856
Published
2026-09-02T19:45:08.510Z
Modified
2026-09-04T03:47:33.742114039Z
Severity
  • 5.5 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P CVSS Calculator
Summary
rowboatlabs rowboat Composio Webhook Endpoint route.ts req.json denial of service
Details

A vulnerability was detected in rowboatlabs rowboat up to 0.9.1. The impacted element is the function request.text/req.json of the file apps/rowboat/app/api/composio/webhook/route.ts of the component Composio Webhook Endpoint. The manipulation results in denial of service. It is possible to launch the attack remotely. The exploit is now public and may be used. Upgrading to version 0.9.2 is sufficient to resolve this issue. Upgrading the affected component is recommended. The legacy Next.js app was deleted at 0.9.2 rather than patched, leaving no security control behind.

Database specific 
{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/84xxx/CVE-2026-84856.json",
    "cna_assigner": "VulDB",
    "cwe_ids": [
        "CWE-404"
    ]
}
References

Affected packages

Git / github.com/rowboatlabs/rowboat

Affected ranges

Type
GIT
Repo
https://github.com/rowboatlabs/rowboat
Events
Introduced
cf478e48223226ac56e586974c8e202f0b11e801
Fixed
c7729c52499512d82f410b4f7fb8929fcf086e40
Database specific
Show details 
{
    "source": [
        "AFFECTED_FIELD",
        "REFERENCES"
    ],
    "extracted_events": [
        {
            "introduced": "0.9.0"
        },
        {
            "last_affected": "0.9.0"
        },
        {
            "introduced": "0.9.1"
        },
        {
            "last_affected": "0.9.1"
        }
    ]
}

Affected versions

0.*
0.9.0
0.9.1
v0.*
v0.9.0
v0.9.1

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-84856.json"