CVE-2026-113656 apostrophecms CVE debrief

Who should care

Defenders responsible for ApostropheCMS deployments, particularly those using the @apostrophecms/form package, should assess exposure and apply patches to prevent disk-exhaustion DoS attacks.

Why it matters

CVE-2026-113656 is a disk-exhaustion DoS vulnerability in ApostropheCMS @apostrophecms/form package prior to version 1.5.5. Unauthenticated users can upload large files, causing disk exhaustion. Defenders should verify exposure, apply patches, and consider compensating controls.

• Unauthenticated users can cause disk-exhaustion DoS by uploading large files
• Defenders need to verify exposure and apply patches to prevent exploitation
• Implementing rate limiting and size limits can help mitigate the vulnerability
• Compensating controls, such as IP blocking or rate limiting, may be necessary until patches can be applied

Technical summary

The @apostrophecms/form package prior to version 1.5.5 is vulnerable to unauthenticated unbounded multipart upload, leading to disk-exhaustion DoS. The form submission endpoint runs `multer({ dest: os.tmpdir() }).any()` before authentication, API-key, CSRF-equivalent, or form-existence logic, with no size/count/rate limits. Unauthenticated users can stream unbounded bodies to disk per request; cleanup occurs only after the full body is received. The vulnerability allows unauthenticated users to upload large files, causing disk exhaustion. Defenders should verify exposure and apply patches to prevent exploitation. Implementing rate limiting and size limits can help mitigate the vulnerability.

Defensive priority

Defenders should prioritize verifying exposure and applying patches for ApostropheCMS @apostrophecms/form versions prior to 1.5.5, as unauthenticated users can cause disk-exhaustion DoS by uploading large files.

Recommended defensive actions

• Verify exposure by checking if @apostrophecms/form versions prior to 1.5.5 are in use
• Apply patches by updating @apostrophecms/form to version 1.5.5 or later
• Monitor for large file uploads and implement rate limiting and size limits
• Consider implementing compensating controls, such as IP blocking or rate limiting, until patches can be applied
• Review relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The source corpus provides details on the vulnerability, including the affected package @apostrophecms/form and the fixed version 1.5.5. However, the corpus does not provide information on known exploitation or impact.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.