@apostrophecms/form vulnerabilities
CVEs whose affected-version data names the @apostrophecms/form package (npm). Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.
2 CVEsRSS
CVE-2026-113667Medium· 5.3ApostropheCMS: CAPTCHA response token not URL-encoded
ApostropheCMS: CAPTCHA response token not URL-encoded
▾ Sunlitapostrophecms · @apostrophecms/formvia GHSA
CVE-2026-113656Medium· 5.3ApostropheCMS: Unauthenticated unbounded multipart upload → disk-exhaustion DoS
ApostropheCMS: Unauthenticated unbounded multipart upload → disk-exhaustion DoS
▾ Sunlitapostrophecms · @apostrophecms/formvia GHSA