CVE-2026-112955
Received Received - Intake

ApostropheCMS Import-Export Module Memory Exhaustion

Publication date: 2026-10-20

Last updated on: 2026-10-20

Assigner: GitHub, Inc.

Description
ApostropheCMS is an open-source Node.js content management system. Prior to 3.7.1 of the import-export module, an authenticated importer can submit archives whose decompressed bytes, entry count, and entry sizes are not bounded before document-type authorization, and extraction or parsing failures can leave staging and extracted artifacts without unconditional cleanup. The already-hardened pre-authentication and write-error paths are separate, and current end-to-end denial-of-service impact from this residual path remains subject to maintainer validation. This issue is fixed in version 3.7.1.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-20
Last Modified
2026-10-20
Generated
2026-10-20
AI Q&A
2026-10-20
EPSS Evaluated
N/A
NVD
CVE-2026-112955
EUVD
EUVD-2026-105105

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
apostrophecms apostrophe < 4.34.0
@apostrophecms import-export < 3.7.1

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-400 The product does not properly control the allocation and maintenance of a limited resource.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

ApostropheCMS is a Node.js content management system. The vulnerability exists in the import-export module before version 3.7.1. An authenticated user can submit archives that are not checked for size, entry count, or byte limits before document-type authorization. This can lead to extraction or parsing failures that leave temporary files without cleanup, potentially causing denial-of-service conditions.

Detection Guidance

Detecting this vulnerability requires checking the version of the ApostropheCMS import-export module. If your system is running a version prior to 3.7.1, it is vulnerable. Use commands like 'npm list @apostrophecms/import-export' or check your package.json file to verify the installed version.

Impact Analysis

An authenticated attacker could exploit this to cause a denial-of-service by filling up storage with leftover files from failed extractions. The impact depends on the system's resources and maintainer validation of the end-to-end effects.

Mitigation Strategies

Immediately update the import-export module to version 3.7.1 or later. Remove any staging or extracted artifacts left from failed imports to prevent potential denial-of-service conditions. Ensure proper cleanup mechanisms are in place for extraction failures.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-112955. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart