A billing flaw in the popular open-source AI API gateway, New API, is under active attack. Tracked as CVE-2026-71479, this integer overflow lets a user with a small balance credit themselves an enormous one. The maintainers confirmed exploitation in the wild and shipped an emergency fix. The flaw scores a CVSS 9.1. New API handles billing and quota for AI applications, breaking that billing integrity. A single crafted request can turn a tiny balance into a huge one. The impact is not just free usage; sustained abuse can drain an operator’s prepaid upstream funds and knock billing and service offline. The project has over 45,000 GitHub stars, which signals wide deployment. New API versions up to and including 1.0.0-rc.17 are affected.
We recommend you to update New API to version 1.0.0-rc.18 or later without delay or 1.0.0-rc.19 for quota-saturation warning logs.[/subscribe_to_unlock_form]
A billing flaw in the popular open-source AI API gateway, New API, is under active attack. Tracked as CVE-2026-71479, this integer overflow lets a user with a small balance credit themselves an enormous one. The maintainers confirmed exploitation in the wild and shipped an emergency fix. The flaw scores a CVSS 9.1. New API handles billing and quota for AI applications, breaking that billing integrity. A single crafted request can turn a tiny balance into a huge one. The impact is not just free usage; sustained abuse can drain an operator’s prepaid upstream funds and knock billing and service offline. The project has over 45,000 GitHub stars, which signals wide deployment. New API versions up to and including 1.0.0-rc.17 are affected.
We recommend you to update New API to version 1.0.0-rc.18 or later without delay or 1.0.0-rc.19 for quota-saturation warning logs.[emaillocker id="1283"]
The following reports contain further technical details:
[/emaillocker]