Signal is active with 2 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Cube is a semantic layer for building data applications. From 1.1.17 to before 1.5.13 and 1.4.2, it is possible to make the entire Cube API unavailable by submitting a specially crafted request to a Cube API endpoint. This vulnerability is fixed in 1.5.13 and 1.4.2.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
| Date | Total | Labels |
|---|
| 2026-02-09 | 1 | Disclosure1 |
| 2026-02-10 | 2 | Disclosure1General1 |
CVE-2026-25957 Denial of Service Vulnerability in Cube API Endpoint Before 1.5.13 and 1.4.2 https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-25957
Post summary
A concise notice identifies CVE‑2026‑25957 as a denial‑of‑service flaw in Cube API endpoints for versions prior to 1.5.13 and 1.4.2, and links to a vulnerability detail page.
CVE-2026-25957: Cube.js Crash Course: Async Nightmares and WebSocket Woes Cube.js, the self-proclaimed 'universal semantic layer' for building data applications, suffered from a classic case of Node.js negligence. By failing to properly await asynchro... https://cvereports.com/reports/CVE-2026-25957
Post summary
CVE-2026-25957 involves a Node.js async handling flaw in Cube.js that can lead to crashes; no PoC, exploit, or patch is discussed.
CVE-2026-25957 Cube is a semantic layer for building data applications. From 1.1.17 to before 1.5.13 and 1.4.2, it is possible to make the entire Cube API unavailable by submitting … https://www.cve.org/CVERecord?id=CVE-2026-25957
Post summary
The text announces a denial‑of‑service vulnerability in Cube, specifying affected versions and the impact of submitting data, but does not provide PoC, exploit code, or patch information.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | cube | cube.js | - | node.js | - |