# CVE-2026-46357: haxtheweb HAX CMS denial of service in createSite endpoint

Source: https://junglewise.ai/threats/cve-2026-46357-haxtheweb-hax-cms-denial-of-service-in-createsite-endpoint  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-05. Updated: 2026-06-05  
License: CC BY 4.0 with a link back

CVE-2026-46357 · Severity: medium · CVSS 6.5 · Published 2026-06-05

HAX CMS is a content management system used to build and manage microsites. A vulnerability in the NodeJS version of the application allows a logged-in user to crash the entire server by sending a single malicious request. This results in a total service outage that requires a manual restart by an administrator to restore access for all users.

Technologies: [Haxtheweb HAX CMS](https://junglewise.ai/threats/technologies/hax-cms), [@haxtheweb/haxcms-nodejs (npm)](https://junglewise.ai/threats/technologies/haxtheweb-haxcms-nodejs). Vendors: [Haxtheweb](https://junglewise.ai/threats/vendors/haxtheweb), [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2026-46357 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-46357 being exploited in the wild.

**How severe is CVE-2026-46357?** Medium severity, with a CVSS score of 6.5, published 5 June 2026.

**Which products and versions are affected?** Haxtheweb HAX CMS < 26.0.0; @haxtheweb/haxcms-nodejs (npm) < 26.0.0, SEMVER:introduced=0,fixed=26.0.0.

**Is there a fix for CVE-2026-46357?** Yes. @haxtheweb/haxcms-nodejs (npm): upgrade to 26.0.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-46357 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-46357?** Check whether you run Haxtheweb HAX CMS or @haxtheweb/haxcms-nodejs (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- @haxtheweb/haxcms-nodejs (npm): upgrade to 26.0.0 or later

  ```sh
  npm install @haxtheweb/haxcms-nodejs@26.0.0
  ```


## Technical details

A Denial of Service (DoS) vulnerability exists in HAX CMS (NodeJS backend) prior to version 26.0.0 due to improper input validation in the site creation flow. The 'createSite' endpoint fails to properly handle file objects during remote imports; specifically, it passes a file object missing the 'originalname' property to HAXCMSFile.save(). This causes a TypeError when the code attempts to call .replace() on an undefined property, resulting in an immediate process crash. An authenticated attacker with low privileges can trigger this crash with a single HTTP POST request to the /system/api/createSite endpoint. The issue is resolved in version 26.0.0.

## Affected products

- haxtheweb HAX CMS (NodeJS backend) < 26.0.0

## Identifiers

- CVE-2026-46357
- GHSA-9r33-xhw8-4qqp

## Timeline

- 2026-05-13: advisory: GitHub Security Advisory published
- 2026-06-05: disclosed: CVE published to NVD

## References

- [https://github.com/haxtheweb/issues/security/advisories/GHSA-9r33-xhw8-4qqp](https://github.com/haxtheweb/issues/security/advisories/GHSA-9r33-xhw8-4qqp)

## Related threats

- [haxtheweb HAX CMS weak PRNG for salts in install.php](https://junglewise.ai/threats/cve-2026-46493-haxtheweb-hax-cms-weak-prng-for-salts-in-install-php)
- [haxtheweb HAX CMS insufficient session expiration](https://junglewise.ai/threats/cve-2026-46401-haxtheweb-hax-cms-insufficient-session-expiration)
- [HAX CMS account takeover via Stored XSS and token exposure](https://junglewise.ai/threats/cve-2026-46511-hax-cms-account-takeover-via-stored-xss-and-token-exposure)
- [haxtheweb HAX CMS stored XSS in video-player component](https://junglewise.ai/threats/cve-2026-46496-haxtheweb-hax-cms-stored-xss-in-video-player-component)
- [haxtheweb HAX CMS authenticated RCE via file overwrite in saveOutline](https://junglewise.ai/threats/cve-2026-46399-haxtheweb-hax-cms-authenticated-rce-via-file-overwrite-in)