Midnight Discloses High-Severity Indexer API Vulnerability

Midnight Indexer maintainers published a security advisory on November 13 for the component that serves blockchain data to applications. The advisory rates the vulnerability as high severity and describes how resource exhaustion can make the API unavailable.

The flaw affects historical stake pool queries

The vulnerability affects how the Indexer handles requests for historical stake pool data. On a vulnerable instance, processing one of these requests can consume resources the API needs to serve other requests. That means the impact can reach applications that use the same Indexer for unrelated blockchain data.

What an Indexer outage means for apps

The Indexer reads and organizes data from a Midnight node. It gives applications a GraphQL API they can use to look up blockchain records and subscribe to updates as new data becomes available.

If the API stops responding, an application that relies on the affected instance may fail to load blockchain records or continue showing older data until the service recovers. The advisory describes a potential service disruption. It gives no account of a production outage.

[NEWSBREAK]

Patched versions and Ledger 9 compatibility

The advisory lists affected versions starting at 3.1.0 and patched versions starting at 4.3.300. For teams running their own Indexer, the relevant release also depends on which version of the Midnight ledger their deployment uses.

Midnight’s release notes identify Indexer 4.4.101, published November 6, as the release for the Ledger 9 mainnet transition. Moving to that release as part of the transition requires rebuilding the index from the network’s first block.