CVE-2026-102615 · Package
NO FIX YET · SEE WHAT TO DO
HeyForm is an open-source form builder whose upload endpoint accepts client-chosen MIME types and serves the file back as text/html with CSP disabled. An attacker can upload HTML that runs with the HeyForm origin when a victim opens the returned link, letting it call the GraphQL API with the victim's session and read or change data that account can access.
first public Aug 6, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Self-hosted or deployed HeyForm instances before 3.0.1 that accept uploads. Any ordinary user account can upload the malicious file, and the impact is on the HeyForm origin, so users who open the link are exposed. The advisory says the public form path was not fully verified, so unknown whether anonymous users can trigger it.
Not affected if version-3.0.1-or-later
Who cares heyform, nodejs, self-hosted
3.0.1 are listed as affected./api/upload and static/upload routes in the deployment.3.0.1HeyForm is an open-source form builder. Prior to 3.0.1, /api/upload accepts a file according to the client-controlled multipart file.mimetype while retaining an HTML filename, and static/upload serves the resulting file as text/html with contentSecurityPolicy: false. An ordinary user can therefore upload active HTML that executes on the HeyForm origin when a victim opens its returned URL. The same-origin script can access /graphql with the victim's session and read or modify data available to that account. The code also permits upload requests tied to an active public form through formId, openToken, and a fieldId belonging to a file or signature question, although the advisory did not fully verify that unauthenticated path end to end. This issue is fixed in version 3.0.1.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.