CVE-2026-64868: New API Denial of Service Vulnerability

{
  "schema_version" : "1.4.0",
  "id" : "GHSA-v828-m3pf-vq9q",
  "modified" : "2026-08-17T16:35:58Z",
  "published" : "2026-08-17T16:35:58Z",
  "aliases" : [ "CVE-2026-64868" ],
  "summary" : "New API: Unauthenticated payment webhooks allow memory and disk DoS via unbounded body reads and full-body logging",
  "details" : "## Summary\n\nUnauthenticated payment webhook endpoints could read and log the entire request body before validating the webhook signature. When a payment webhook was enabled, an unauthenticated attacker could send oversized requests to public callback endpoints and force excessive memory use and log growth before the request was rejected.\n\nAffected public endpoints included:\n\n- `POST /api/stripe/webhook`\n- `POST /api/creem/webhook`\n- `POST /api/waffo/webhook`\n\nThis issue did not allow forging successful payments, because signature validation still guarded the payment processing logic. The vulnerable behavior was the expensive unauthenticated request processing that occurred before signature validation.\n\n## Impact\n\nA remote unauthenticated attacker could cause denial of service through memory pressure, container OOM/restarts, or disk consumption from full-body logging. The impact is availability-only and is rated High.\n\n## Affected versions\n\nVersions before `v1.0.0-rc.11` are affected. The earlier affected range of `<= v1.0.0-rc.7` was incomplete; the anonymous request body limit was introduced later and first appears in `v1.0.0-rc.11`.\n\n## Patches\n\nThis issue is fixed in `v1.0.0-rc.11`. The fix adds `middleware.AnonymousRequestBodyLimit()` and applies it to unauthenticated POST routes, including the payment webhook callbacks. The default limit is controlled by `ANONYMOUS_REQUEST_BODY_LIMIT_KB` and defaults to 512 KiB.\n\n## Workarounds\n\nIf upgrading immediately is not possible, operators should disable unused payment webhooks, enforce request body limits at a reverse proxy or load balancer, and ensure application and container logs have rotation and quotas. These mitigations reduce exposure but do not replace upgrading.\n\n## References\n\n- Fixed by commit `d2f7f9ee3adf3ef66798783a60d7bc712451c85c`.\n- Relevant code paths: `router/api-router.go`, `middleware/request_body_limit.go`, `controller/topup_stripe.go`, `controller/topup_creem.go`, and `controller/topup_waffo.go`.",
  "severity" : [ {
    "type" : "CVSS_V3",
    "score" : "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
  } ],
  "affected" : [ {
    "package" : {
      "ecosystem" : "Go",
      "name" : "github.com/QuantumNous/new-api"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "0"
      }, {
        "fixed" : "1.0.0-rc.11"
      } ]
    } ]
  } ],
  "references" : [ {
    "type" : "WEB",
    "url" : "https://github.com/QuantumNous/new-api/security/advisories/GHSA-v828-m3pf-vq9q"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/QuantumNous/new-api/pull/5244"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/QuantumNous/new-api/commit/d2f7f9ee3adf3ef66798783a60d7bc712451c85c"
  }, {
    "type" : "PACKAGE",
    "url" : "https://github.com/QuantumNous/new-api"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/QuantumNous/new-api/releases/tag/v1.0.0-rc.11"
  } ],
  "database_specific" : {
    "cwe_ids" : [ "CWE-400", "CWE-770" ],
    "severity" : "HIGH",
    "github_reviewed" : true,
    "github_reviewed_at" : "2026-08-17T16:35:58Z",
    "nvd_published_at" : null
  }
}