# Jetpack <= 4.8.1 - Unauthenticated Denial of Service via _jb_static Concatenation Endpoint

- **ID:** WPSEC-2026-2709
- **Plugin:** Jetpack Boost – Website Speed, Performance and Critical CSS (`jetpack-boost`), https://wordpress.org/plugins/jetpack-boost/
- **Affected versions:** all versions before 4.8.2
- **Fixed in:** 4.8.2 (Update to 4.8.2 or later.)
- **Severity:** High 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
- **Weakness:** CWE-400
- **Usage among sites WPSec scans:** plugin Low, affected versions Low (as of 2026-11-07)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/jetpack-boost
- **Fix released:** 2026-11-06
- **Published:** 2026-11-07
- **URL:** https://wpsec.com/vuln/WPSEC-2026-2709/

## Description

The Jetpack Boost plugin for WordPress is vulnerable to Denial of Service via the _jb_static script and style concatenation endpoint in all versions up to, and including, 4.8.1. This is due to the endpoint accepting any caller-supplied list of the site's CSS and JavaScript files, decompressing encoded lists without a size limit, applying no limit to the size of the files read or the output built, and writing every response to a disk cache keyed on a hash of the raw request URI with no limit on the cache directory's size. This makes it possible for unauthenticated attackers to fill the server's disk with cache files and use up its CPU. They do this by sending many concatenation requests whose URIs differ only slightly.

## References

- https://wpsec.com/vuln/WPSEC-2026-2709/
- https://plugins.svn.wordpress.org/jetpack-boost/tags/4.8.2/
- https://wordpress.org/plugins/jetpack-boost/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-2709/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.