CVE-2026-46357

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-46357", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-05-13T18:37:30.991Z", "datePublished": "2026-06-05T19:21:03.297Z", "dateUpdated": "2026-06-09T14:36:15.648Z"}, "containers": {"cna": {"title": "HAX CMS NodeJS application Vulnerable to Denial of Service using Malicious Import Request", "problemTypes": [{"descriptions": [{"cweId": "CWE-20", "lang": "en", "description": "CWE-20: Improper Input Validation", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}}], "references": [{"name": "https://github.com/haxtheweb/issues/security/advisories/GHSA-9r33-xhw8-4qqp", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/haxtheweb/issues/security/advisories/GHSA-9r33-xhw8-4qqp"}], "affected": [{"vendor": "haxtheweb", "product": "haxcms-nodejs", "versions": [{"version": "< 26.0.0", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-06-05T19:21:03.297Z"}, "descriptions": [{"lang": "en", "value": "HAX CMS helps manage microsite universe with PHP or NodeJs backends. Prior to version 26.0.0, the HAX CMS NodeJS application crashes when an authenticated attacker sends a specially crafted site creation request to the createSite endpoint. A single request is sufficient to take the entire application offline, requiring a manual server restart to restore service. Version 26.0.0 fixes the issue."}], "source": {"advisory": "GHSA-9r33-xhw8-4qqp", "discovery": "UNKNOWN"}}, "adp": [{"references": [{"url": "https://github.com/haxtheweb/issues/security/advisories/GHSA-9r33-xhw8-4qqp", "tags": ["exploit"]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-06-09T14:21:36.375730Z", "id": "CVE-2026-46357", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-06-09T14:36:15.648Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-46357", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-06-09T14:21:36.375730Z"}}}], "references": [{"url": "https://github.com/haxtheweb/issues/security/advisories/GHSA-9r33-xhw8-4qqp", "tags": ["exploit"]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-06-09T14:21:45.613Z"}}], "cna": {"title": "HAX CMS NodeJS application Vulnerable to Denial of Service using Malicious Import Request", "source": {"advisory": "GHSA-9r33-xhw8-4qqp", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}}], "affected": [{"vendor": "haxtheweb", "product": "haxcms-nodejs", "versions": [{"status": "affected", "version": "< 26.0.0"}]}], "references": [{"url": "https://github.com/haxtheweb/issues/security/advisories/GHSA-9r33-xhw8-4qqp", "name": "https://github.com/haxtheweb/issues/security/advisories/GHSA-9r33-xhw8-4qqp", "tags": ["x_refsource_CONFIRM"]}], "descriptions": [{"lang": "en", "value": "HAX CMS helps manage microsite universe with PHP or NodeJs backends. Prior to version 26.0.0, the HAX CMS NodeJS application crashes when an authenticated attacker sends a specially crafted site creation request to the createSite endpoint. A single request is sufficient to take the entire application offline, requiring a manual server restart to restore service. Version 26.0.0 fixes the issue."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-20", "description": "CWE-20: Improper Input Validation"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-06-05T19:21:03.297Z"}}}, "cveMetadata": {"cveId": "CVE-2026-46357", "state": "PUBLISHED", "dateUpdated": "2026-06-09T14:36:15.648Z", "dateReserved": "2026-05-13T18:37:30.991Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-06-05T19:21:03.297Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "haxcms-nodejs", "vendor": "haxtheweb", "versions": [{"status": "affected", "version": "< 26.0.0"}]}], "source": "security-advisories@github.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "HAX CMS helps manage microsite universe with PHP or NodeJs backends. Prior to version 26.0.0, the HAX CMS NodeJS application crashes when an authenticated attacker sends a specially crafted site creation request to the createSite endpoint. A single request is sufficient to take the entire application offline, requiring a manual server restart to restore service. Version 26.0.0 fixes the issue."}, {"lang": "es", "value": "HAX CMS ayuda a gestionar el universo de micrositios con backends de PHP o NodeJs. Antes de la versi\u00f3n 26.0.0, la aplicaci\u00f3n NodeJS de HAX CMS se bloquea cuando un atacante autenticado env\u00eda una solicitud de creaci\u00f3n de sitio especialmente dise\u00f1ada al endpoint createSite. Una sola solicitud es suficiente para dejar toda la aplicaci\u00f3n fuera de l\u00ednea, requiriendo un reinicio manual del servidor para restaurar el servicio. La versi\u00f3n 26.0.0 soluciona el problema."}], "id": "CVE-2026-46357", "lastModified": "2026-07-23T07:10:00.113", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 3.6, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-46357", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-06-09T14:21:36.375730Z", "version": "2.0.3"}}]}, "published": "2026-06-05T20:17:33.190", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/haxtheweb/issues/security/advisories/GHSA-9r33-xhw8-4qqp"}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "url": "https://github.com/haxtheweb/issues/security/advisories/GHSA-9r33-xhw8-4qqp"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-20"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,26.0.0)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "haxcms-nodejs", "source": "cna", "vendor": "haxtheweb"}, "product": "haxcms-nodejs", "vendor": "haxtheweb"}], "created": "2026-06-05T20:45:04.377100+00:00", "updated": "2026-06-05T21:00:04.732261+00:00", "vendors": ["haxtheweb", "haxtheweb$PRODUCT$haxcms-nodejs"]}