VDB
KO
MEDIUM 5.5

GHSA-w2cg-vxx6-5xjg

OpenClaw: denial of service through large base64 media files allocating large buffers before limit checks

Details

## Summary

Base64-backed media inputs could be decoded into Buffers before enforcing decoded-size budgets. An attacker supplying oversized base64 payloads can force large allocations, causing memory pressure and denial of service.

## Attack Scenario Notes

- Recommended deployments bind the gateway to loopback by default and require gateway auth for HTTP endpoints. In that configuration, this is best modeled as a local/authorized DoS. - If an operator exposes the gateway to untrusted networks (or disables/weakens auth and rate limits), treat this as a higher-severity network DoS risk.

## Affected Packages / Versions

- openclaw (npm): <= 2026.2.13 - clawdbot (npm): <= 2026.1.24-3

## Fixed In

- openclaw (npm): 2026.2.14 (planned) - clawdbot (npm): no patched release planned; migrate to openclaw

## Fix Commit(s)

- 31791233d60495725fa012745dde8d6ee69e9595

## Credits Thanks @vincentkoc for reporting.

Are you affected?

Enter the version of the package you're using.

Affected packages

npm / openclaw
Introduced in: 0 Fixed in: 2026.2.14
Fix npm install openclaw@2026.2.14
npm / clawdbot
Introduced in: 0

No fixed version published yet for clawdbot (npm). Pin to a known-safe version or switch to an alternative.

References