CVE-2026-113656

The ApostropheCMS Form add-on for Node.js is vulnerable to a denial of service (DoS) via disk exhaustion. Prior to version 1.5.5 , the form submission route processes unbounded multipart uploads without prior authentication, validation, or enforcement of size, count, and rate limits. An unauthent...

CVE-2026-34829 Rack: Denial of Service via Unbounded Multipart File Upload Without Content-Length

Rack is a modular Ruby web server interface. Prior to versions 2.2.23, 3.1.21, and 3.2.6, Rack::Multipart::Parser only wraps the request body in a BoundedIO when CONTENTLENGTH is present. When a multipart/form-data request is sent without a Content-Length header, such as with HTTP chunked transfe...