Patch Forecast
Yellow warning
Plan into this sprint.

CVE-2026-113667 · GHSA-44qr-rrjg-2cqq

ApostropheCMS: CAPTCHA response token not URL-encoded

Risk score
42/100
CVSS
5.3 v4.0
Exploit chance (30 days)
0.4%
Published
20 Oct 2026

Open in the live forecast Today's forecast

What to know

What it is
ApostropheCMS is an open-source Node.js content management system. Prior to 1.5.5 of the Form add-on, 1.2.1 of login-recaptcha, and 1.3.0 of login-hcaptcha, these three CAPTCHA integrations interpolate an unencoded user-supplied response token into the provider verification request. Crafted tokens can smuggle request …
Affected
@apostrophecms/form (npm) < 1.5.5; @apostrophecms/login-recaptcha (npm) < 1.2.1; @apostrophecms/login-hcaptcha (npm) < 1.3.0
Fix
Upgrade @apostrophecms/form to 1.5.5; @apostrophecms/login-recaptcha to 1.2.1; @apostrophecms/login-hcaptcha to 1.3.0 or later.
Exploitation
No known exploitation

Story map

Story map: @apostrophecms/formTHE FLAWSTHE FIXCVE-2026-113667ApostropheCMS: CAPTCHAresponse token notURL-encodedCVSS 5.3 · EPSS 0%CVE-2026-113656ApostropheCMS:Unauthenticated unboundedmultipart upload →…CVSS 5.3 · EPSS 0%Upgrade…1.5.5or later on your release lineWho is exposed@apostrophecms/form (npm) <1.5.5YELLOW · PLAN IT IN@apostrophecms/formApostropheCMS is anopen-source Node.js contentmanagement system. Prior to1.5.5 of the ApostropheCMSForm add-on, its formsubmission route stagesunbounded multipart uploads…Where it standsNo known exploitationCONNECTS TOSame weaknessCWE-116 (CWE-116)34 other warnings in 30 days →
Story map: the flaws, the fix, how it unfolded and what it connects to. Boxes link to the record or article.

At a glance

@apostrophecms/form: Yellow, plan it in. ApostropheCMS is an open-source Node.js content management system. Prior to 1.5.5 of the ApostropheCMS Form add-on, its form submission route stages unbounded multipart uploads before form validation or authentication and lacks upload size, count, and rate limits. Repeated unauthenticated submissions can consume tempo…

The flaws

  • CVE-2026-113667: ApostropheCMS: CAPTCHA response token not URL-encoded (CVSS 5.3 · EPSS 0%)
  • CVE-2026-113656: ApostropheCMS: Unauthenticated unbounded multipart upload → disk-exhaustion DoS (CVSS 5.3 · EPSS 0%)

The fix

Upgrade @apostrophecms/form: 1.5.5 or later on your release line

Who is exposed: @apostrophecms/form (npm) < 1.5.5

Where it stands

  • No known exploitation

Connects to

Why it is Yellow

  • CVSS 5.3 medium
  • On your watchlist: npm

Affected packages

PackageEcosystemVulnerableFixed in
@apostrophecms/formnpm< 1.5.51.5.5
@apostrophecms/login-recaptchanpm< 1.2.11.2.1
@apostrophecms/login-hcaptchanpm< 1.3.01.3.0

References

Original description

ApostropheCMS is an open-source Node.js content management system. Prior to 1.5.5 of the Form add-on, 1.2.1 of login-recaptcha, and 1.3.0 of login-hcaptcha, these three CAPTCHA integrations interpolate an unencoded user-supplied response token into the provider verification request. Crafted tokens can smuggle request parameters and disrupt CAPTCHA verification and CAPTCHA-gated form or login flows; automated bypass probing is possible, but a successful CAPTCHA bypass or secret disclosure is not established. This issue is fixed in Form 1.5.5, login-recaptcha 1.2.1, and login-hcaptcha 1.3.0.

Last activity 20 Oct 2026. Patch Forecast updates every hour.