{"id":"ghsa-ghsa-89mh-mm8c-mv7f","seq":2422,"kind":"advisory","title":"ApostropheCMS: Unauthenticated unbounded multipart upload → disk-exhaustion DoS","url":"https://github.com/advisories/GHSA-89mh-mm8c-mv7f","permalink":"https://vulnpulse.app/items/ghsa-ghsa-89mh-mm8c-mv7f","summary":"影響: npm:@apostrophecms/form < 1.5.5 → 1.5.5\nSummary The form submission endpoint runs multer({ dest: os.tmpdir() }).any() before authentication, API-key, CSRF-equivalent, or form-existence logic, with no size/count/rate limits. Unauthenticated users can stream unbounded bodies to disk per request; cleanup occurs only after the full body is received. Details packages/form/index.js apiRoutes.post.submit (L274–296): [ multer({ dest: os.tmpdir() }).any(), self.normalizeFiles, async function (req) { try { submitForm } finally { unlink files }…","severity":"medium","techs":["nodejs"],"cves":["CVE-2026-113656"],"tags":["GHSA-89mh-mm8c-mv7f","@apostrophecms/form"],"source":{"id":"ghsa","name":"GitHub Advisory Database"},"published_at":"2026-10-20T18:08:31.000Z","fetched_at":"2026-10-21T16:17:46.637Z"}