CVE-2026-46357

HAX CMS helps manage microsite universe with PHP or NodeJs backends. Prior to version 26.0.0, the HAX CMS NodeJS application crashes when an authenticated attacker sends a specially crafted site creation request to the createSite endpoint. A single request is sufficient to take the entire...

CVE-2026-46357

CVE-2026-46357 affects HAX CMS NodeJS backend. An authenticated attacker can crash the NodeJS process by sending a malformed request to the remote import workflow via the createSite endpoint, causing an availability DoS with a single HTTP request. The crash originates from a file object without o...

@haxtheweb/create (>=0.1.3, <=26.0.0), @haxtheweb/open-apis (>=11.0.2, <=26.0.0) potentially affected by CVE-2026-46493 via @haxtheweb/haxcms-nodejs (>=0.0.13, <=25.0.0)

@haxtheweb/haxcms-nodejs NPM version =0.0.13, =0.1.3, =11.0.2, =26.0.0 Source cves: CVE-2026-46493 Source advisory: MEND:CVE-2026-46493...

@haxtheweb/create (>=0.1.3, <=26.0.0), @haxtheweb/open-apis (>=11.0.2, <=26.0.0) potentially affected by CVE-2026-46401 via @haxtheweb/haxcms-nodejs (>=0.0.13, <=25.0.0)

@haxtheweb/haxcms-nodejs NPM version =0.0.13, =0.1.3, =11.0.2, =26.0.0 Source cves: CVE-2026-46401 Source advisory: MEND:CVE-2026-46401...

CVE-2026-46395

HAX CMS helps manage microsite universe with PHP or NodeJs backends. Prior to version 26.0.0, the hmacBase64 function in the HAXcms Node.js backend contains two critical cryptographic implementation errors that together allow any unauthenticated attacker to extract the system’s private signing ke...

@haxtheweb/create (>=25.0.2, <=26.0.0), @haxtheweb/open-apis (>=25.0.0, <=26.0.0) potentially affected by CVE-2026-46398 via @haxtheweb/haxcms-nodejs (25.0.0)

@haxtheweb/haxcms-nodejs NPM version 25.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on @haxtheweb/haxcms-nodejs and may be impacted: - @haxtheweb/create =25.0.2, =25.0.0, =26.0.0 Source cves: CVE-2026-46398 Source advisory: MEND:CVE-2026-46398...

@haxtheweb/create (>=0.1.3, <=26.0.0), @haxtheweb/open-apis (>=11.0.2, <=26.0.0) potentially affected by CVE-2026-46397 via @haxtheweb/haxcms-nodejs (>=0.0.13, <=25.0.0)

@haxtheweb/haxcms-nodejs NPM version =0.0.13, =0.1.3, =11.0.2, =26.0.0 Source cves: CVE-2026-46397 Source advisory: MEND:CVE-2026-46397...

@haxtheweb/create (>=0.1.3, <=26.0.0), @haxtheweb/open-apis (>=11.0.2, <=26.0.0) potentially affected by CVE-2026-46496 via @haxtheweb/haxcms-nodejs (>=0.0.13, <=25.0.0)

@haxtheweb/haxcms-nodejs NPM version =0.0.13, =0.1.3, =11.0.2, =26.0.0 Source cves: CVE-2026-46496 Source advisory: MEND:CVE-2026-46496...

@haxtheweb/create (>=0.1.3, <=26.0.0), @haxtheweb/open-apis (>=11.0.2, <=26.0.0) potentially affected by CVE-2026-46396 via @haxtheweb/haxcms-nodejs (>=0.0.13, <=25.0.0)

@haxtheweb/haxcms-nodejs NPM version =0.0.13, =0.1.3, =11.0.2, =26.0.0 Source cves: CVE-2026-46396 Source advisory: MEND:CVE-2026-46396...

@haxtheweb/create (>=0.1.3, <=26.0.0), @haxtheweb/open-apis (>=11.0.2, <=26.0.0) potentially affected by CVE-2026-46511 via @haxtheweb/haxcms-nodejs (>=0.0.13, <=25.0.0)

@haxtheweb/haxcms-nodejs NPM version =0.0.13, =0.1.3, =11.0.2, =26.0.0 Source cves: CVE-2026-46511 Source advisory: MEND:CVE-2026-46511...

CVE-2026-46395 HAX CMS Vulnerable to Private Key Disclosure via Broken HMAC Implementation

HAX CMS helps manage microsite universe with PHP or NodeJs backends. Prior to version 26.0.0, the hmacBase64 function in the HAXcms Node.js backend contains two critical cryptographic implementation errors that together allow any unauthenticated attacker to extract the system’s private signing ke...

@haxtheweb/create (>=0.1.3, <=26.0.0), @haxtheweb/open-apis (>=11.0.2, <=26.0.0) potentially affected by CVE-2026-46395 via @haxtheweb/haxcms-nodejs (>=0.0.13, <=25.0.0)

@haxtheweb/haxcms-nodejs NPM version =0.0.13, =0.1.3, =11.0.2, =26.0.0 Source cves: CVE-2026-46395 Source advisory: MEND:CVE-2026-46395...

@haxtheweb/create (>=0.1.3, <=26.0.0), @haxtheweb/open-apis (>=11.0.2, <=26.0.0) potentially affected by CVE-2026-46393 via @haxtheweb/haxcms-nodejs (>=0.0.13, <=25.0.0)

@haxtheweb/haxcms-nodejs NPM version =0.0.13, =0.1.3, =11.0.2, =26.0.0 Source cves: CVE-2026-46393 Source advisory: MEND:CVE-2026-46393...

@haxtheweb/create (>=9.0.1, <=26.0.0), @haxtheweb/open-apis (>=11.0.2, <=26.0.0) potentially affected by CVE-2026-46390 via @haxtheweb/haxcms-nodejs (>=9.0.21, <=25.0.0)

@haxtheweb/haxcms-nodejs NPM version =9.0.21, =9.0.1, =11.0.2, =26.0.0 Source cves: CVE-2026-46390 Source advisory: MEND:CVE-2026-46390...

@haxtheweb/create (>=0.1.3, <=26.0.0), @haxtheweb/open-apis (>=11.0.2, <=26.0.0) potentially affected by CVE-2026-46399 via @haxtheweb/haxcms-nodejs (>=0.0.13, <=25.0.0)

@haxtheweb/haxcms-nodejs NPM version =0.0.13, =0.1.3, =11.0.2, =26.0.0 Source cves: CVE-2026-46399 Source advisory: MEND:CVE-2026-46399...

CVE-2025-11215 affecting package nodejs for versions less than 24.14.1-3

CVE-2025-11215 affecting package nodejs for versions less than 24.14.1-3. An upgraded version of the package is available that resolves this issue...

CVE-2025-12432 affecting package nodejs for versions less than 24.14.1-3

CVE-2025-12432 affecting package nodejs for versions less than 24.14.1-3. An upgraded version of the package is available that resolves this issue...

CVE-2025-13227 affecting package nodejs for versions less than 24.14.1-3

CVE-2025-13227 affecting package nodejs for versions less than 24.14.1-3. An upgraded version of the package is available that resolves this issue...

CVE-2025-13224 affecting package nodejs for versions less than 24.14.1-3

CVE-2025-13224 affecting package nodejs for versions less than 24.14.1-3. An upgraded version of the package is available that resolves this issue...

CVE-2026-4450 affecting package nodejs for versions less than 24.14.1-3

CVE-2026-4450 affecting package nodejs for versions less than 24.14.1-3. An upgraded version of the package is available that resolves this issue...