CVE-2026-25957: 
JavaScript vulnerability analysis and mitigation

CVE-2026-25957 is a Denial of Service (DoS) vulnerability in Cube, a semantic layer for building data applications. It affects the @cubejs-backend/server-core npm package in versions >= 1.1.17 and < 1.4.2, and >= 1.5.0 and < 1.5.13. An authenticated attacker with low privileges can submit a specially crafted request to a Cube API endpoint to render the entire Cube API unavailable. The vulnerability was disclosed on February 9, 2026, and carries a CVSS v3.1 base score of 6.5 (Medium) (GitHub Advisory, Cube Security Advisory).

The root cause is classified as CWE-755 (Improper Handling of Exceptional Conditions), meaning the Cube API server fails to properly handle or recover from an exceptional condition triggered by a malformed or specially crafted request. The attack vector is network-based, requires low privileges (authenticated access), and no user interaction, making it straightforward to exploit once an attacker has valid credentials. The vulnerability was discovered internally by Cube Core engineer Dmitrii Patsura (@ovr) and reported via the project's internal Slack channel (GitHub Advisory, Cube Security Advisory).

Successful exploitation causes the entire Cube API to become unavailable, resulting in a complete denial of service for all API consumers and dependent data applications. There is no confidentiality or integrity impact — the vulnerability is limited to availability. Organizations relying on Cube as a semantic layer for analytics or data pipelines would experience full service disruption until the process is restarted or patched (GitHub Advisory).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time. The EPSS score is approximately 0.013% (6th percentile), indicating a low near-term probability of exploitation. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires authenticated access with low privileges, which somewhat limits the attack surface compared to unauthenticated vulnerabilities (GitHub Advisory, Feedly).

Cube has released patched versions addressing this vulnerability: 1.5.13 (regular release channel) and 1.4.2 (active LTS release). Organizations running any version from 1.1.17 through 1.5.12 or 1.4.0–1.4.1 should upgrade immediately. As interim mitigations, administrators should implement network access controls to restrict who can submit requests to Cube API endpoints, apply API rate limiting, and monitor for unusual or malformed requests (GitHub Advisory, Cube Security Advisory).

The vulnerability was discovered and reported internally by Cube Core engineer Dmitrii Patsura (@ovr) via the project's internal Slack channel, and was promptly patched. No significant external researcher commentary or notable media coverage has been identified beyond standard vulnerability database aggregation (Cube Security Advisory).