CVE-2026-113656: CWE-770: Allocation of Resources Without Limits or Throttling in apostrophecms apostrophe
Description
ApostropheCMS Form add-on versions prior to 1.5.5 have a vulnerability where the form submission route processes multipart uploads without limits on size, count, or rate before validation or authentication. This can allow repeated unauthenticated submissions to consume excessive temporary disk storage, potentially disrupting form handling or other services on the host. The issue is fixed in version 1.5.5 of the ApostropheCMS Form add-on.
CVSS v3.1
Score 5.3medium
Affected software
apostrophecms
apostrophe
@apostrophecms
form
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-113656 describes a resource allocation vulnerability (CWE-770) in ApostropheCMS, an open-source Node.js content management system. Specifically, versions of the ApostropheCMS Form add-on prior to 1.5.5 stage multipart uploads without enforcing limits on upload size, count, or rate before form validation or authentication. This lack of throttling allows unauthenticated attackers to repeatedly submit forms, consuming temporary disk storage and potentially disrupting form handling or other host services. The vulnerability is resolved in ApostropheCMS Form add-on version 1.5.5.
Potential Impact
The vulnerability can lead to denial of service conditions by exhausting temporary disk storage through repeated unauthenticated multipart form submissions. This disruption affects form handling and may impact other services hosted on the same system. There is no confidentiality or integrity impact reported.
Mitigation Recommendations
Upgrade the ApostropheCMS Form add-on to version 1.5.5 or later, where the issue is fixed by enforcing upload size, count, and rate limits before processing multipart uploads. No other mitigation is indicated.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- GitHub_M
- Date Reserved
- 2026-10-20T14:27:46.641Z
- Cvss Version
- 3.1
- State
- PUBLISHED
Threat ID: 6ad79f0d2cdf04f656455937
Added to database: 10/20/2026, 17:04:13 UTC
Last enriched: 10/20/2026, 17:18:26 UTC
Last updated: 10/20/2026, 19:06:08 UTC
Views: 11
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.