Is CVE-2026-63429 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-63429 being exploited in the wild.

How severe is CVE-2026-63429?

High severity, with a CVSS score of 8.6, published 20 July 2026.

Is there a fix for CVE-2026-63429?

A patch was published on 2026-06-25: Fix commit pushed to repository Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-63429 attacked?

It is attacked over the network, in a hosted service.

Am I affected by CVE-2026-63429?

Check whether you run HeyForm at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-63429: HeyForm missing authentication in file upload API

CVE-2026-63429 · Severity: high · CVSS 8.6 · Published 2026-07-20

HeyForm, an open-source form builder, contains a security flaw that allows any anonymous internet user to upload files to the server without a password or session. Attackers can use this to host malicious files on a legitimate-looking domain for phishing or to exhaust the server's storage capacity. This could lead to service outages or reputational damage if the platform is used to distribute malware.

Technologies: HeyForm. Vendors: HeyForm.

Quick answers

Is CVE-2026-63429 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-63429 being exploited in the wild.
How severe is CVE-2026-63429?: High severity, with a CVSS score of 8.6, published 20 July 2026.
Which products and versions are affected?: HeyForm < 3.0.0-rc.9.
Is there a fix for CVE-2026-63429?: A patch was published on 2026-06-25: Fix commit pushed to repository Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-63429 attacked?: It is attacked over the network, in a hosted service.
Am I affected by CVE-2026-63429?: Check whether you run HeyForm at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The `UploadController` in HeyForm lacks authentication decorators (such as `@UseGuards()`) on the `/api/upload` endpoint, and the application does not implement global guards or form-context validation for this route. This allows unauthenticated remote attackers to upload arbitrary files (up to 10MB) including PDFs, Office documents, and media files. Upon successful upload, the server returns a permanent public URL. This vulnerability can be exploited for unauthorized file hosting, phishing campaigns, or storage exhaustion (denial of service). The issue is fixed in version 3.0.0-rc.9 by hardening the form security surfaces.

Affected products

HeyForm HeyForm < 3.0.0-rc.9

Timeline

2026-06-25: patched: Fix commit pushed to repository
2026-07-01: advisory: GitHub Security Advisory published
2026-07-20: disclosed: CVE published in NVD

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.