CVE-2026-113656: ApostropheCMS Unauthenticated Unbounded Multipart Upload Leading to Disk-Exhaustion DoS
Summary
CVE-2026-113656: ApostropheCMS: Unauthenticated unbounded multipart upload → disk-exhaustion DoS. Affects @apostrophecms/form versions < 1.5.5. Fixed in 1.5.5. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
ApostropheCMS is a popular open-source content management system (CMS) designed for building websites and applications with a focus on ease of use and flexibility. It allows developers to create rich content experiences with features like in-context editing, customizable workflows, and a modular architecture. However, a vulnerability has been identified in the '@apostrophecms/form' package, which can lead to severe resource exhaustion if exploited by unauthenticated users.
Vulnerability Detail
The vulnerability arises from the form submission endpoint that utilizes the multer middleware for handling file uploads without proper authentication or validation. Specifically, it allows unauthenticated users to upload files of arbitrary size, leading to potential disk exhaustion on the server. The lack of limits on file size, count, and rate means that an attacker can continuously send large files, filling up the temporary storage and causing a denial of service (DoS) by crashing the server. The cleanup of temporary files only occurs after the entire body is received, which exacerbates the issue.
How To Fix
Latest published version: 1.5.6 as of 22 Oct 2026
npm install @apostrophecms/form@1.5.6Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.5.5
This is the first release that contains the fix.
npm install @apostrophecms/form@1.5.5Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As an immediate workaround, you can implement rate limiting and authentication checks before the multer middleware is invoked. This can help mitigate the risk of abuse until a proper fix is applied. Example code for rate limiting:
const rateLimit = require('express-rate-limit');
const limiter = rateLimit({
windowMs: 15 * 60 * 1000, // 15 minutes
max: 100 // Limit each IP to 100 requests per windowMs
});
app.use('/api/v1/@apostrophecms/form/submit', limiter);
Conclusion
The CVE-2026-113656 vulnerability in the '@apostrophecms/form' package poses a significant risk of disk exhaustion due to unauthenticated file uploads. It is crucial to update to the patched version and implement additional security measures to safeguard your application from potential attacks.
See every vulnerability recorded for @apostrophecms/form →
FAQ
The CVSS score of this vulnerability is 5.3, indicating a moderate severity level.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. You can check your application using the Vulert playground at Vulert Scanner without any signup.
If exploited, this vulnerability can lead to disk exhaustion on the server, causing a denial of service (DoS) by crashing the application.
Yes, the vulnerability has been patched in version 1.5.5 of the '@apostrophecms/form' package. It is recommended to update to this version or later.
In addition to updating the package, implement proper authentication checks, set limits on file uploads, and consider using rate limiting to prevent abuse.
References
Related vulnerabilities
Recent vulnerabilities recorded for @apostrophecms/form.
