@apostrophecms/form vulnerabilities (npm)

2 vulnerabilities.

• @apostrophecms/form npm ApostropheCMS: CAPTCHA response token not URL-encoded CVE-2026-113667 Fix available 5.3 MediumOctober 20, 2026
• @apostrophecms/form npm ApostropheCMS: Unauthenticated unbounded multipart upload → disk-exhaustion DoS CVE-2026-113656 Fix available 5.3 MediumOctober 20, 2026