CVE-2026-46357
CVE-2026-46357 · HAX CMS NodeJS application Vulnerable to Denial of Service using Malicious Import Request
This page contains facts from public vulnerability sources. Check the original advisory before updating.
HAX CMS helps manage microsite universe with PHP or NodeJs backends. Prior to version 26.0.0, the HAX CMS NodeJS application crashes when an authenticated attacker sends a specially crafted site creation request to the createSite endpoint. A single request is sufficient to take the entire application offline, requiring a manual server restart to restore service. Version 26.0.0 fixes the issue.
CVSS 6.5 · Medium · EPSS 0.2% · Fix available
- Published
- Updated
Stack: node
Affected products and versions
haxcms-nodejs
- Versions
- < 26.0.0: Affected
No fix published
@haxtheweb/haxcms-nodejs npm
- Affected ranges
- SEMVER: < 26.0.0
Update to 26.0.0