CVE-2026-112955

Deferred Deferred - Pending Action

ApostropheCMS Import-Export Module Memory Exhaustion

Publication date: 2026-10-20

Last updated on: 2026-10-26

Assigner: GitHub, Inc.

Description

ApostropheCMS is an open-source Node.js content management system. Prior to 3.7.1 of the import-export module, an authenticated importer can submit archives whose decompressed bytes, entry count, and entry sizes are not bounded before document-type authorization, and extraction or parsing failures can leave staging and extracted artifacts without unconditional cleanup. The already-hardened pre-authentication and write-error paths are separate, and current end-to-end denial-of-service impact from this residual path remains subject to maintainer validation. This issue is fixed in version 3.7.1.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-20

Last Modified

2026-10-26

Generated

2026-11-09

AI Q&A

2026-10-20

EPSS Evaluated

2026-11-08

NVD

CVE-2026-112955

EUVD

EUVD-2026-105105

Affected Vendors & Products

Vendor	Product	Version / Range
apostrophecms	apostrophe	< 4.34.0
@apostrophecms	import-export	< 3.7.1

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-400	The product does not properly control the allocation and maintenance of a limited resource.

Attack-Flow Graph

Executive Summary

ApostropheCMS is a Node.js content management system. The vulnerability exists in the import-export module before version 3.7.1. An authenticated user can submit archives that are not checked for size, entry count, or byte limits before document-type authorization. This can lead to extraction or parsing failures that leave temporary files without cleanup, potentially causing denial-of-service conditions.

Detection Guidance

Detecting this vulnerability requires checking the version of the ApostropheCMS import-export module. If your system is running a version prior to 3.7.1, it is vulnerable. Use commands like 'npm list @apostrophecms/import-export' or check your package.json file to verify the installed version.

Impact Analysis

An authenticated attacker could exploit this to cause a denial-of-service by filling up storage with leftover files from failed extractions. The impact depends on the system's resources and maintainer validation of the end-to-end effects.

Compliance Impact

This vulnerability primarily impacts availability by allowing excessive server storage consumption through uncontrolled archive extraction, which could lead to system downtime or degraded performance. While not directly violating GDPR or HIPAA, such disruptions may hinder compliance with requirements for data availability, integrity, and timely access in regulated environments.

Mitigation Strategies

Immediately update the import-export module to version 3.7.1 or later. Remove any staging or extracted artifacts left from failed imports to prevent potential denial-of-service conditions. Ensure proper cleanup mechanisms are in place for extraction failures.

Hi! I’m here to help you understand CVE-2026-112955. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70

EPSS Chart

Security Radar

News mentioning this vulnerability

Loading related security news...