Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
6.5
CVE-2026-46357: HAX CMS NodeJS crashes from a crafted site‑creation request
CVE-2026-46357 · published 5 months ago
Summary
The HAX CMS NodeJS version before 26.0.0 stops working when an authenticated user sends a specially formed request to create a site. This can shut down the whole application and requires a manual restart. Upgrade to version 26.0.0 or later to prevent the shutdown.
What to do
- Update haxtheweb haxcms-nodejs to version 26.0.0.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| npm | haxtheweb | haxcms-nodejs |
< 26.0.0 Fix: upgrade to 26.0.0
|
Original advisory text
HAX CMS: Denial of Service using Malicious Import Request
HAX CMS helps manage microsite universe with PHP or NodeJs backends. Prior to version 26.0.0, the HAX CMS NodeJS application crashes when an authenticated attacker sends a specially crafted site creation request to the createSite endpoint. A single request is sufficient to take the entire application offline, requiring a manual server restart to restore service. Version 26.0.0 fixes the issue.
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker partial control
Type
CWE-476NULL Pointer Dereference
CWE-20Improper Input Validation
Timeline
Published5 Jun 2026
Updated4 Nov 2026
First seen19 May 2026
Track software like this
Free during beta