Is CVE-2026-113656 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-113656 being exploited in the wild.

How severe is CVE-2026-113656?

Medium severity, with a CVSS score of 5.3, published 20 October 2026.

Which products and versions are affected?

ApostropheCMS Form add-on before 1.5.5; @apostrophecms/form (npm) < 1.5.5, SEMVER:introduced=0,fixed=1.5.5.

Is there a fix for CVE-2026-113656?

Yes. @apostrophecms/form (npm): upgrade to 1.5.5 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-113656 attacked?

It is attacked over the network.

Am I affected by CVE-2026-113656?

Check whether you run ApostropheCMS Form add-on or @apostrophecms/form (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-113656: ApostropheCMS Form add-on unbounded multipart upload denial of service

Q: Is there a fix for CVE-2026-113656?

Yes. @apostrophecms/form (npm): upgrade to 1.5.5 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-113656 attacked?

It is attacked over the network.

Q: Am I affected by CVE-2026-113656?

Check whether you run ApostropheCMS Form add-on or @apostrophecms/form (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-113656 · Severity: medium · CVSS 5.3 · Published 2026-10-20

ApostropheCMS is an open-source Node.js-based content management system used to build and manage websites. The Form add-on accepts file uploads before validating the request or checking user permissions, and does not limit upload size, frequency, or concurrent uploads. An unauthenticated attacker can repeatedly submit large files to exhaust the server's temporary disk storage, disrupting form handling and potentially affecting other services on the same host.

Vendors: ApostropheCMS, npm.

Quick answers

Is CVE-2026-113656 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-113656 being exploited in the wild.
How severe is CVE-2026-113656?: Medium severity, with a CVSS score of 5.3, published 20 October 2026.
Which products and versions are affected?: ApostropheCMS Form add-on before 1.5.5; @apostrophecms/form (npm) < 1.5.5, SEMVER:introduced=0,fixed=1.5.5.
Is there a fix for CVE-2026-113656?: Yes. @apostrophecms/form (npm): upgrade to 1.5.5 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-113656 attacked?: It is attacked over the network.
Am I affected by CVE-2026-113656?: Check whether you run ApostropheCMS Form add-on or @apostrophecms/form (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

@apostrophecms/form (npm): upgrade to 1.5.5 or later
```
npm install @apostrophecms/form@1.5.5
```

Technical details

The form submission route in ApostropheCMS Form versions before 1.5.5 stages unbounded multipart uploads to temporary storage before form validation or authentication checks occur. The lack of upload size limits, file count restrictions, and rate limiting allows an unauthenticated remote attacker to repeatedly submit multipart requests that consume disk space and degrade host performance. The vulnerability is resolved in version 1.5.5.

Affected products

ApostropheCMS Form add-on before 1.5.5

Identifiers

CVE-2026-113656
GHSA-89mh-mm8c-mv7f

Timeline

2026-10-20: disclosed
2026-09-30: patched

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.