CVE-2026-113650
Received Received - Intake

HTML iframe Content Sanitization Stack Overflow in ApostropheCMS

Publication date: 2026-10-20

Last updated on: 2026-10-20

Assigner: GitHub, Inc.

Description
ApostropheCMS is an open-source Node.js content management system. In sanitize-html 2.18.0, when an <iframe> is not allowed and disallowedTagsMode is 'discard' (the defaults), its raw-text content is re-sanitized by a recursive call to sanitizeHtml(text, options). The recursion has no bound and starts each nested call with a fresh state. This vulnerability is fixed in 2.18.1.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-20
Last Modified
2026-10-20
Generated
2026-10-20
AI Q&A
2026-10-20
EPSS Evaluated
N/A
NVD
CVE-2026-113650
EUVD
EUVD-2026-105176

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
apostrophecms apostrophe < 4.34.0
apostrophecms sanitize-html >= 2.18.0, < 2.18.1

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-674 The product does not properly control the amount of recursion that takes place, consuming excessive resources, such as allocated memory or the program stack.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is an unbounded recursion issue in sanitize-html version 2.18.0. When an iframe tag is not allowed and the disallowedTagsMode is set to 'discard', the library recursively re-sanitizes the raw text content of the discarded iframe. Each recursive call starts fresh, ignoring nesting limits, allowing arbitrary nesting depth. This leads to a stack overflow when processing unclosed iframe tags.

Detection Guidance

Check if your system uses sanitize-html version 2.18.0. Run: npm list sanitize-html. If version 2.18.0 is installed, the system is vulnerable. Test with crafted iframe tags to trigger recursion, e.g., <iframe><iframe><iframe>... (unclosed). Monitor for stack overflow errors or crashes.

Impact Analysis

The primary impact is low availability due to potential denial of service. An attacker could craft a small input causing a RangeError from exceeding the maximum call stack size. This crashes the application, making it unavailable for legitimate users.

Mitigation Strategies

Upgrade sanitize-html to version 2.18.1 or later. Update ApostropheCMS if it depends on the vulnerable version. Set nestingLimit in sanitize-html options to prevent unbounded recursion. Review and restrict iframe handling in input sanitization policies.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-113650. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart