## ApostropheCMS: Unauthenticated unbounded multipart upload → disk-exhaustion DoS

- 種別: advisory
- 重大度: medium
- 関連技術: nodejs
- CVE: CVE-2026-113656
- 公開日時: 2026-10-20T18:08:31.000Z
- 情報源: GitHub Advisory Database (https://github.com/advisories/GHSA-89mh-mm8c-mv7f)
- パーマリンク: https://vulnpulse.app/items/ghsa-ghsa-89mh-mm8c-mv7f

影響: npm:@apostrophecms/form < 1.5.5 → 1.5.5
Summary The form submission endpoint runs multer({ dest: os.tmpdir() }).any() before authentication, API-key, CSRF-equivalent, or form-existence logic, with no size/count/rate limits. Unauthenticated users can stream unbounded bodies to disk per request; cleanup occurs only after the full body is received. Details packages/form/index.js apiRoutes.post.submit (L274–296): [ multer({ dest: os.tmpdir() }).any(), self.normalizeFiles, async function (req) { try { submitForm } finally { unlink files }…