6.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-25957

CVE-2026-25957: Cube Denial of Service (DoS) - An authenticated attacker can crash the server by sending a specially crafted request

Cube is a semantic layer for building data applications. From 1.1.17 to before 1.5.13 and 1.4.2, it is possible to make the entire Cube API unavailable by submitting a specially crafted request to a Cube API endpoint. This vulnerability is fixed in 1.5.13 and 1.4.2.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-25957

CVE-2026-25957:

6.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
@cubejs-backend/server-core	npm	>= 1.1.17, < 1.4.2	1.4.2
@cubejs-backend/server-core	npm	>= 1.5.0, < 1.5.13	1.5.13

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a Denial of Service in Cube Core, caused by an unhandled exception when processing a specially crafted WebSocket message. The analysis of the provided patches for version 1.4.2 reveals that the core of the vulnerability lies in the handling of 'unsubscribe' messages within the API gateway.

The commit 71c41a2326150c82f7d83e46ed14b00fd1fed72b is the key to understanding the vulnerability. It modifies the validation schema in packages/cubejs-api-gateway/src/ws/message-schema.ts to allow the messageId in an 'unsubscribe' message to be an integer, whereas previously only a string was accepted. This implies that sending an 'unsubscribe' message with an integer messageId would cause a validation error.

The vulnerable function is identified as SubscriptionServer.processMessage, which is the entry point for processing WebSocket messages. An unhandled exception from the validation logic within this function would propagate and crash the Node.js process, thus causing a denial of service. The added test case in packages/cubejs-api-gateway/test/ws/subscription-server.test.ts confirms that a numeric messageId is now a valid input.

The function LocalSubscriptionStore.unsubscribe was also modified to support the numeric messageId, indicating it is part of the vulnerable execution path.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.