Vulnerability · CVE-2026-113650
ApostropheCMS is an open-source Node.js content management system.
Published Oct 20, 2026 · catalog updated Oct 21, 2026 · ApostropheCMS is an open-source
Last checked Nov 7, 2026. A connected source was read within the last 7 days.
Check if you run it
No confirmed exploitation is on record for CVE-2026-113650. EPSS is 0.48%. Act only if a listed version of ApostropheCMS is an open-source is installed.
Gaps on this record
- The stored product name is a package slug. The name on this page is taken from the title (ApostropheCMS is an open-source).
- No vendor fix or required action is stored. Compare the linked advisory before you change production.
- Severity
- Medium5.3
- Known exploitation
- Not in CISA/VulnCheck KEV
- EPSS
- 0.48%
- Remediation
- Version ranges on file
- Affected products
- npm sanitize-html
### Summary Since 2.18.0, when an is not allowed and is (the defaults), its raw-text content is re-sanitized by a recursive call to (the change from #5564, fixing #5550). The recursion has no bound and starts each nested call with a fresh state. Two consequences, both absent from 2.17.7 and 2.17.4: 1. A few kilobytes of unclosed tags throw with the default options. Any application that sanitizes untrusted HTML with 2.18.0 can be made to throw on a small crafted input. 2. is not enforced across a discarded iframe: each nested iframe restarts the depth count at zero, so the output can be nested arbitrarily deep regardless of the configured limit. ### Affected versions - 2.18.0 (the current ), and the branch at the time of writing (the recursive call is still in , in the handler, branch ). - Not affected: 2.17.7 and 2.17.4 (tested with the same inputs below). Tested with Node.js v26.7.0. ### Reproduction 1: stack overflow with the default options Results: | input | 2.17.4 | 2.17.7 | 2.18.0 | |---|---|---|---| | | ok | ok | ok | | | ok | ok | RangeError | | | ok | ok | RangeError | The threshold depends on the remaining stack, so it is lower when is called from an already deep call stack (for example inside a server-side rendering pass). ### Reproduction 2: is bypassed Without an iframe, the same options cap the output at three nested in all three versions. With repetitions of , 2.18.0 returns nested (measured for k = 1, 5, 50: depth 3, 15, 150). ### Cause In 2.18.0 the handler does: Because htmlparser2 treats as a raw-text element, the text of an unclosed iframe is the whole remainder of the input; re-parsing it can meet another unclosed , and so on, one stack frame (and one full re-parse) per iframe. The nested call also starts with its own , so tags inside the fallback are not counted against together with the enclosing tags. ### Possible directions Not a patch, only what would close both effects: bound the recursion (or process the fallback without recursing), and c
Are you affected?
Enter the version you run. The result uses only the ranges stored on this record.
The check returns affected, not affected, or incomplete. It does not guess a version that is missing from the record.
- npm sanitize-html2.18.0 → 2.18.1
- npm sanitize-html>= 2.18.0, < 2.18.1
How to fix CVE-2026-113650
Upgrade
CVE-2026-113650 lists a fix boundary at 2.18.1. Compare the installed build with that boundary before you change production.
Version check
Affected < 2.18.1
Advisory
Open the cve_org record and follow its fix.
Official advisories
What to do
Three questions, each answered from this record only. Confirm the vendor advisory before you patch.
Should you patch?
No confirmed exploitation is on record for CVE-2026-113650. EPSS is 0.48%. Act only if a listed version of ApostropheCMS is an open-source is installed.
Which versions are affected?
Compare what you have installed with 2.18.0 → 2.18.1, >= 2.18.0, < 2.18.1. Compare the installed version with the linked vendor advisory before you change production.
What should an analyst verify?
CWE-674. EPSS 0.48%. There is no CISA KEV listing. No Exploit-DB or Metasploit reference is linked. Use the source links for the original advisory.
Code
The project this record applies to. Exploit listings stay in References.
Timeline
Detection, updates, and resolution for this record.
Oct 20, 2026 · NIST NVD
Detected
ApostropheCMS is an open-source Node.js content management system. In sanitize-html 2.18.0, when an is not allowed and disallowedTagsMode is 'discard' (the defaults), its raw-text content is re-sanitized by a recursive call to sanitizeHtml(text, options). The recursion has no bound and starts each nested call with a fresh state. This vulnerability is fixed in 2.18.1.
Oct 20, 2026 · NIST NVD
Updated
ApostropheCMS is an open-source Node.js content management system. In sanitize-html 2.18.0, when an is not allowed and disallowedTagsMode is 'discard' (the defaults), its raw-text content is re-sanitized by a recursive call to sanitizeHtml(text, options). The recursion has no bound and starts each nested call with a fresh state. This vulnerability is fixed in 2.18.1.
Oct 21, 2026 · GitHub Advisory Database
Fix available
sanitize-html fixed in 2.18.1
Oct 21, 2026 · GitHub Advisory Database
Fix available
sanitize-html fixed in 2.18.1
Oct 21, 2026 · GitHub Advisory Database
Updated
### Summary Since 2.18.0, when an is not allowed and is (the defaults), its raw-text content is re-sanitized by a recursive call to (the change from #5564, fixing #5550). The recursion has no bound and starts each nested call with a fresh state. Two consequences, both absent from 2.17.7 and 2.17.4: 1. A few kilobytes of unclosed tags throw with the default options. Any application that sanitizes u
Sources
- CVE.orgVulnerability recordCVE-2026-113650
Official CVE identifier
cve.org - FIRST EPSSExploitation probabilityCVE-2026-113650
30-day exploitation probability 0.48%
first.org - GitHub Advisory DatabasePackage advisoryGHSA-c9rx-x947-fp3h
ApostropheCMS sanitize-html: unbounded recursion when re-sanitizing the fallback of a discarded iframe (stack overflow, nestingLimit not enforced)
github.com - GitLab Advisory DatabasePackage advisoryCVE-2026-113650
Since 2.18.0, when an is not allowed and disallowedTagsMode is 'discard' (the defaults), its raw-text content is re-sanitized by a recursive call to sanitizeHtml(text, options) (the change from #5564, fixing #5550). The recursion has no bound and starts each nested call with a fresh state. Two consequences, both absent from 2.17.7 and 2.17.4: A few kilobytes of unclosed tags throw RangeError: Maxi
advisories.gitlab.com - NIST NVDVulnerability recordCVE-2026-113650
ApostropheCMS is an open-source Node.js content management system. In sanitize-html 2.18.0, when an is not allowed and disallowedTagsMode is 'discard' (the defaults), its raw-text content is re-sanitized by a recursive call to sanitizeHtml(text, options). The recursion h
nvd.nist.gov - OpenSSF OSV / OSV ScannerPackage advisoryGHSA-c9rx-x947-fp3h
ApostropheCMS sanitize-html: unbounded recursion when re-sanitizing the fallback of a discarded iframe (stack overflow, nestingLimit not enforced)
osv.dev
References
Freshness
Last verified in this catalog Nov 7, 2026. Significant claims (KEV, EPSS, CVSS, affected ranges) come from the source rows above — open the original publisher for the authoritative advisory.
- FIRST EPSSNov 7, 2026
- GitLab Advisory DatabaseOct 23, 2026
- GitHub Advisory DatabaseOct 22, 2026
- CVE.orgOct 21, 2026
- OpenSSF OSV / OSV ScannerOct 21, 2026
- NIST NVDOct 21, 2026