# CVE-2026-63429: HeyForm missing authentication in file upload API

Source: https://junglewise.ai/threats/cve-2026-63429-heyform-missing-authentication-in-file-upload-api  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-20. Updated: 2026-07-20  
License: CC BY 4.0 with a link back

CVE-2026-63429 · Severity: high · CVSS 8.6 · Published 2026-07-20

HeyForm, an open-source form builder, contains a security flaw that allows any anonymous internet user to upload files to the server without a password or session. Attackers can use this to host malicious files on a legitimate-looking domain for phishing or to exhaust the server's storage capacity. This could lead to service outages or reputational damage if the platform is used to distribute malware.

Technologies: [HeyForm](https://junglewise.ai/threats/technologies/heyform). Vendors: [HeyForm](https://junglewise.ai/threats/vendors/heyform).

## Quick answers

**Is CVE-2026-63429 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-63429 being exploited in the wild.

**How severe is CVE-2026-63429?** High severity, with a CVSS score of 8.6, published 20 July 2026.

**Which products and versions are affected?** HeyForm < 3.0.0-rc.9.

**Is there a fix for CVE-2026-63429?** A patch was published on 2026-06-25: Fix commit pushed to repository Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-63429 attacked?** It is attacked over the network, in a hosted service.

**Am I affected by CVE-2026-63429?** Check whether you run HeyForm at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The `UploadController` in HeyForm lacks authentication decorators (such as `@UseGuards()`) on the `/api/upload` endpoint, and the application does not implement global guards or form-context validation for this route. This allows unauthenticated remote attackers to upload arbitrary files (up to 10MB) including PDFs, Office documents, and media files. Upon successful upload, the server returns a permanent public URL. This vulnerability can be exploited for unauthorized file hosting, phishing campaigns, or storage exhaustion (denial of service). The issue is fixed in version 3.0.0-rc.9 by hardening the form security surfaces.

## Affected products

- HeyForm HeyForm < 3.0.0-rc.9

## Timeline

- 2026-06-25: patched: Fix commit pushed to repository
- 2026-07-01: advisory: GitHub Security Advisory published
- 2026-07-20: disclosed: CVE published in NVD

## References

- [https://github.com/heyform/heyform/commit/092e255e9e02565de1b3c057f3dad849160952d2](https://github.com/heyform/heyform/commit/092e255e9e02565de1b3c057f3dad849160952d2)
- [https://github.com/heyform/heyform/security/advisories/GHSA-432x-54v2-p7p7](https://github.com/heyform/heyform/security/advisories/GHSA-432x-54v2-p7p7)

## Related threats

- [HeyForm stored cross-site scripting in file upload](https://junglewise.ai/threats/cve-2026-102615-heyform-is-an-open-source-form-builder-prior-to-3-0-1-api-upload)
- [HeyForm CORS misconfiguration with credential handling](https://junglewise.ai/threats/cve-2026-82291-heyform-cors-misconfiguration-with-credential-handling)
- [HeyForm improper input validation in hiddenFields submission](https://junglewise.ai/threats/cve-2026-63428-heyform-improper-input-validation-in-hiddenfields-submission)
- [HeyForm unauthenticated stored XSS via SVG file upload](https://junglewise.ai/threats/cve-2026-45797-heyform-unauthenticated-stored-xss-via-svg-file-upload)
- [HeyForm stored XSS in form builder field titles](https://junglewise.ai/threats/cve-2026-35198-heyform-stored-xss-in-form-builder-field-titles)