---
id: CVE-2026-71479
title: >-
  New API is a large language mode (LLM) gateway and artificial intelligence
  (AI) asset management system
summary: >-
  New API is a large language mode (LLM) gateway and artificial intelligence
  (AI) asset management system. Prior to 1.0.0-rc.18, user-controlled image n,
  video seconds and duration, max_tokens, max_completion_tokens,
  maxOutputTokens, audio…
severity: critical
cvss: 9.1
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H'
cwe:
  - CWE-190
  - CWE-682
vendor: QuantumNous
product: github.com/QuantumNous/new-api
affected:
  - github.com/QuantumNous/new-api <= 1.0.0-rc.17
patched:
  - github.com/QuantumNous/new-api 1.0.0-rc.18
published: '2026-08-17'
updated: '2026-09-18'
sourceUpdated: '2026-09-18T20:09:01.757'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-71479'
references:
  - url: >-
      https://github.com/QuantumNous/new-api/commit/c9943d37ad93477dd937fc4901cc3c4e0fd8aaab
    label: security-advisories@github.com
  - url: >-
      https://github.com/QuantumNous/new-api/commit/d0bd8aac742d1e160a5ca61743fe35f4fff880e8
    label: security-advisories@github.com
  - url: 'https://github.com/QuantumNous/new-api/releases/tag/v1.0.0-rc.18'
    label: security-advisories@github.com
  - url: >-
      https://github.com/QuantumNous/new-api/security/advisories/GHSA-8r8v-xf7q-rcpr
    label: security-advisories@github.com
  - url: 'https://github.com/advisories/GHSA-8r8v-xf7q-rcpr'
tags:
  - nvd
  - ghsa
  - go
epss: 0.00519
epssPercentile: 0.4316
aliases:
  - GHSA-8r8v-xf7q-rcpr
ecosystem: go
ingestedAt: '2026-08-17T16:57:25.440Z'
---

## Overview

New API is a large language mode (LLM) gateway and artificial intelligence (AI) asset management system. Prior to 1.0.0-rc.18, user-controlled image n, video seconds and duration, max_tokens, max_completion_tokens, maxOutputTokens, audio duration, and billing-expression quantities can overflow conversions in common/quota_math.go and related settlement paths, allowing a low-privileged account with positive balance or an active subscription to turn a negative charge into account credit and potentially drain upstream funds. This issue is fixed in version 1.0.0-rc.18.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

## Package advisory (CVE-2026-71479)

Affected packages:

- `github.com/QuantumNous/new-api <= 1.0.0-rc.17`

Patched in:

- `github.com/QuantumNous/new-api 1.0.0-rc.18`

Source: https://github.com/advisories/GHSA-8r8v-xf7q-rcpr