CVE-2026-46357: haxtheweb HAX CMS denial of service in createSite endpoint

CVE-2026-46357 · Severity: medium · CVSS 6.5 · Published 2026-06-05

HAX CMS is a content management system used to build and manage microsites. A vulnerability in the NodeJS version of the application allows a logged-in user to crash the entire server by sending a single malicious request. This results in a total service outage that requires a manual restart by an administrator to restore access for all users.

Technologies: Haxtheweb HAX CMS, @haxtheweb/haxcms-nodejs (npm). Vendors: Haxtheweb, npm.

Quick answers

Is CVE-2026-46357 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-46357 being exploited in the wild.
How severe is CVE-2026-46357?
Medium severity, with a CVSS score of 6.5, published 5 June 2026.
Which products and versions are affected?
Haxtheweb HAX CMS < 26.0.0; @haxtheweb/haxcms-nodejs (npm) < 26.0.0, SEMVER:introduced=0,fixed=26.0.0.
Is there a fix for CVE-2026-46357?
Yes. @haxtheweb/haxcms-nodejs (npm): upgrade to 26.0.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-46357 attacked?
It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-46357?
Check whether you run Haxtheweb HAX CMS or @haxtheweb/haxcms-nodejs (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • @haxtheweb/haxcms-nodejs (npm): upgrade to 26.0.0 or later
    npm install @haxtheweb/haxcms-nodejs@26.0.0

Technical details

A Denial of Service (DoS) vulnerability exists in HAX CMS (NodeJS backend) prior to version 26.0.0 due to improper input validation in the site creation flow. The 'createSite' endpoint fails to properly handle file objects during remote imports; specifically, it passes a file object missing the 'originalname' property to HAXCMSFile.save(). This causes a TypeError when the code attempts to call .replace() on an undefined property, resulting in an immediate process crash. An authenticated attacker with low privileges can trigger this crash with a single HTTP POST request to the /system/api/createSite endpoint. The issue is resolved in version 26.0.0.

Affected products

  • haxtheweb HAX CMS (NodeJS backend) < 26.0.0

Identifiers

  • CVE-2026-46357
  • GHSA-9r33-xhw8-4qqp

Timeline

  • 2026-05-13: advisory: GitHub Security Advisory published
  • 2026-06-05: disclosed: CVE published to NVD

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.