high · 7.5CVE-2026-64868Aug 17, 2026

CVE-2026-64868: new-api Unauthenticated Webhook DoS via Unbounded Body Read

Shubham Kandhare
Security Engagement Manager, SecureLayer7

Unauthenticated attackers could crash or destabilize a new-api instance by sending oversized HTTP requests to payment webhook endpoints, because the server read and logged the full request body…

Packagegithub.com/QuantumNous/new-api
Ecosystemgo
Affected< 1.0.0-rc.11
Fixed in1.0.0-rc.11
CVE-2026-64868: new-api Unauthenticated Webhook DoS via Unbounded Body Read

The problem

Three public payment webhook endpoints, POST /api/stripe/webhook, POST /api/creem/webhook, and POST /api/waffo/webhook, read the entire request body into memory and wrote it to application logs before performing any signature validation.

No authentication or size cap protected this path. An attacker with network access to the instance could repeatedly send multi-megabyte or gigabyte-scale requests to exhaust heap memory, trigger container OOM kills, or fill the log volume. Payment integrity was not at risk, but availability was.

Proof of concept

A working proof-of-concept for CVE-2026-64868 in github.com/QuantumNous/new-api, with the exact payload below.

http
# Flood any of the three unauthenticated webhook endpoints with an oversized body.
# The server buffers the full body and logs it before rejecting the request.
# Repeat in parallel to sustain memory pressure / log-disk exhaustion.

POST /api/stripe/webhook HTTP/1.1
Host: <target>
Content-Type: application/json
Content-Length: 104857600

{"payload": "<100 MB of arbitrary data, e.g. 'A' * 104857600>"}

# Same attack applies to /api/creem/webhook and /api/waffo/webhook.

Before the patch, router/api-router.go registered these three POST routes under an unauthenticated group with no body-size middleware. Each controller (topup_stripe.go, topup_creem.go, topup_waffo.go) called ioutil.ReadAll or equivalent on the raw request body and passed the result to a logger, then to signature verification.

The fix (commit d2f7f9ee) introduces middleware.AnonymousRequestBodyLimit() and applies it to all unauthenticated POST routes. The middleware caps incoming bodies at 512 KiB by default, configurable via ANONYMOUS_REQUEST_BODY_LIMIT_KB, and returns HTTP 413 before the controller reads a single byte.

Root cause is CWE-770 (Allocation of Resources Without Limits or Throttling): there was no guard between the network socket and the unbounded ReadAll call on a public, pre-auth code path.

The fix

Upgrade to v1.0.0-rc.11 or later. The AnonymousRequestBodyLimit middleware is enabled by default at 512 KiB. If you need a different cap, set the ANONYMOUS_REQUEST_BODY_LIMIT_KB environment variable. If upgrading immediately is not possible, configure your reverse proxy or load balancer to enforce a request body size limit on the three webhook paths, and ensure log rotation and disk quotas are in place.

Reported by seefs001.

References: [1][2][3][4][5]

Related research