CVE-2026-46357CWE-20

HAX CMS NodeJS application Vulnerable to Denial of Service using Malicious Import Request

Medium · published June 5, 2026

CVSS v3.1
6.5
EPSS
0%
Percentile
34.2
In the wild
Unconfirmed
What it is

HAX CMS helps manage microsite universe with PHP or NodeJs backends. Prior to version 26.0.0, the HAX CMS NodeJS application crashes when an authenticated attacker sends a specially crafted site creation request to the createSite endpoint. A single request is sufficient to take the entire application offline, requiring a manual server restart to restore service. Version 26.0.0 fixes the issue.

The record
Technical detail
CVSS v3.1
6.5 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CVSS v4.0
Not supplied
EPSS
0.00411 · 34.2th percentile
Weakness
CWE-20 · Improper Input Validation
Published
2026-06-05T19:21Z
EPSS history
Timeline
  • 05 JUN 19:21Z
    HAX CMS NodeJS application Vulnerable to Denial of Service using Malicious Import Request
    cvelistv5