CVE-2026-113656

Name of the Vulnerable Software and Affected Versions ApostropheCMS Form versions prior to 1.5.5

Description The form submission endpoint '/api/v1/@apostrophecms/form/submit' processes unbounded multipart uploads using the multer() function before performing authentication, API-key verification, or form-existence logic. The system lacks limits on upload size, file count, and request rates. Unauthenticated users can stream large request bodies to the temporary disk storage, which can exhaust the /tmp filesystem and saturate the event loop, leading to a remote denial of service (DoS) that disrupts form handling and other host services.

Recommendations Update ApostropheCMS Form to version 1.5.5. As a temporary mitigation, restrict access to the '/api/v1/@apostrophecms/form/submit' endpoint or implement per-IP rate limiting at the network level.