Allocation of Resources Without Limits or Throttling

Overview @apostrophecms/form is a Build forms for ApostropheCMS in a simple user interface. Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via an unspecified vector in the form submission handling logic, allowing a remote unauthenticated...

Improper Encoding or Escaping of Output

Overview @apostrophecms/form is a Build forms for ApostropheCMS in a simple user interface. Affected versions of this package are vulnerable to Improper Encoding or Escaping of Output via insufficient enforcement of hCaptcha verification in the login flow, allowing an authenticated low-privileged...

CVE-2026-113656

ApostropheCMS is an open-source Node.js content management system. Prior to 1.5.5 of the ApostropheCMS Form add-on, its form submission route stages unbounded multipart uploads before form validation or authentication and lacks upload size, count, and rate limits. Repeated unauthenticated...

EUVD-2026-105185

ApostropheCMS is an open-source Node.js content management system. Prior to 1.5.5 of the ApostropheCMS Form add-on, its form submission route stages unbounded multipart uploads before form validation or authentication and lacks upload size, count, and rate limits. Repeated unauthenticated...

CVE-2026-113656

The ApostropheCMS Form add-on for Node.js is vulnerable to a denial of service (DoS) via disk exhaustion. Prior to version 1.5.5 , the form submission route processes unbounded multipart uploads without prior authentication, validation, or enforcement of size, count, and rate limits. An unauthent...

CVE-2026-113656 ApostropheCMS: Unauthenticated unbounded multipart upload → disk-exhaustion DoS

ApostropheCMS is an open-source Node.js content management system. Prior to 1.5.5 of the ApostropheCMS Form add-on, its form submission route stages unbounded multipart uploads before form validation or authentication and lacks upload size, count, and rate limits. Repeated unauthenticated...

CVE-2026-113656 ApostropheCMS: Unauthenticated unbounded multipart upload → disk-exhaustion DoS

ApostropheCMS is an open-source Node.js content management system. Prior to 1.5.5 of the ApostropheCMS Form add-on, its form submission route stages unbounded multipart uploads before form validation or authentication and lacks upload size, count, and rate limits. Repeated unauthenticated...

CVE-2026-113656

ApostropheCMS is an open-source Node.js content management system. Prior to 1.5.5 of the ApostropheCMS Form add-on, its form submission route stages unbounded multipart uploads before form validation or authentication and lacks upload size, count, and rate limits. Repeated unauthenticated...

CVE-2026-113656 ApostropheCMS: Unauthenticated unbounded multipart upload → disk-exhaustion DoS

ApostropheCMS is an open-source Node.js content management system. Prior to 1.5.5 of the ApostropheCMS Form add-on, its form submission route stages unbounded multipart uploads before form validation or authentication and lacks upload size, count, and rate limits. Repeated unauthenticated...

PT-2026-118501

Name of the Vulnerable Software and Affected Versions ApostropheCMS Form versions prior to 1.5.5 Description The form submission endpoint '/api/v1/@apostrophecms/form/submit' processes unbounded multipart uploads using the multer function before performing authentication, API-key verification, or...