CVE-2026-54297: Faraday NestedParamsEncoder Stack Exhaustion Denial of Service

Technical summary

The vulnerability resides in Faraday::NestedParamsEncoder, the library's default handler for nested query parameters. The encoder decodes query strings into Ruby Hash objects without enforcing a maximum nesting depth. When processing an attacker-crafted query string with extremely deep nesting levels, the resulting Hash structure causes the internal dehash routine to recurse without depth limits. At sufficient recursion depth, Ruby's interpreter raises an uncaught SystemStackError exception, terminating the calling thread. This is a stack-exhaustion attack exploiting the lack of nesting depth validation during both decoding and the subsequent recursive traversal of the constructed data structure.

Business impact

For SaaS platforms, microservices, and API gateways that use Faraday to proxy or parse user-supplied requests, this vulnerability enables attackers to trigger denial of service by sending crafted HTTP requests. Each malicious request can crash a worker thread, reducing application availability. Widespread exploitation could exhaust all worker threads in a Ruby process pool, making the service unresponsive. Applications that construct Faraday requests from user input or accept query strings from external sources face the highest risk.

Affected systems

Ruby applications using Faraday library versions 1.0.0 through 1.10.5 or 2.0.0 through 2.14.2 are affected. The vulnerability is triggered when these versions process user-controlled query parameters—either directly via Faraday's URL building or through the NestedParamsEncoder. Applications that never use nested parameter encoding or that validate query parameter structure before passing to Faraday are not impacted.

Exploitability

Exploitability is high. The attack requires only network access to send a specially crafted HTTP request; no authentication or user interaction is necessary. Constructing a deeply nested query string is trivial and does not require specialized tools. An attacker can test for vulnerability by sending progressively deeper nested parameters and observing whether the application becomes unresponsive. There is no CISA KEV entry for this vulnerability as of the publication date, indicating it has not been observed in active exploitation campaigns in the wild to date.

Remediation

Upgrade Faraday to version 1.10.6 or later if using the 1.x branch, or to version 2.14.3 or later if using the 2.x branch. Review your Gemfile and update the dependency constraint to pull the patched version. After updating, redeploy affected applications and verify that your HTTP client functionality remains operational in your test environment before rolling out to production.

Patch guidance

For Ruby on Rails and bundled gem-based projects: (1) Update your Gemfile to require 'faraday', '~> 1.10.6' or 'faraday', '~> 2.14.3' depending on your major version. (2) Run 'bundle update faraday' to pull the patched version. (3) Test HTTP client interactions in staging to confirm no regressions. For pinned dependencies, verify against the official Faraday GitHub release page that the version number you are adopting is indeed 1.10.6, 2.14.3, or later. Note that intermediate patch versions may exist; always verify against the vendor advisory for the complete list of safe versions.

Detection guidance

Monitor application logs for SystemStackError exceptions with stack traces mentioning Faraday or nested parameter decoding. Implement request-level logging of inbound query parameters and alert on unusually deep nesting patterns (e.g., more than 50 levels of nested brackets in a single query string). Rate-limit or reject requests with excessively nested query structures at your API gateway or load balancer. For runtime detection, instrument your Faraday middleware to track query parameter depth and abort processing if nesting exceeds a safe threshold (typically 10–20 levels depending on your application's legitimate use cases).

Why prioritize this

This vulnerability scores 7.5 (HIGH) under CVSS 3.1 due to its network-accessible attack surface, lack of authentication requirements, and direct impact on availability. Although not yet observed in active exploitation, the ease of crafting a malicious payload and the potential for complete service disruption in production environments warrant prompt patching. Organizations running customer-facing APIs or microservices that handle user-supplied URLs should prioritize this update.

Risk score, explained

The CVSS 3.1 score of 7.5 reflects: Attack Vector = Network (AV:N), indicating no special access or proximity is required; Attack Complexity = Low (AC:L), as crafting a malicious query string is trivial; Privileges Required = None (PR:N) and User Interaction = None (UI:N), as the attack is fully automated; Scope = Unchanged (S:U), affecting only the vulnerable service; Confidentiality and Integrity = None (C:N, I:N), as the attack does not leak data or corrupt state; Availability = High (A:H), as the vulnerability directly crashes worker threads. The HIGH severity designation appropriately reflects the ease of exploitation and the guaranteed availability impact.

Frequently asked questions