CVE-2026-63429: HeyForm Auth Bypass Vulnerability

CVE-2026-63429 Overview

HeyForm, an open-source form builder, contains a missing authentication vulnerability in its file upload endpoint prior to version 3.0.0-rc.9. The POST /api/upload route lacks any authentication guard, global guard, form-context validation, openToken requirement, or session cookie check. Any anonymous internet user can upload files up to 10 MB, including PDF, DOC/DOCX, XLS/XLSX, CSV, TXT, MP4, and images. Each upload returns a permanent public URL hosted on the HeyForm domain. The flaw is classified under CWE-306: Missing Authentication for a Critical Function. Version 3.0.0-rc.9 contains a patch.

Critical Impact
Unauthenticated attackers can abuse HeyForm instances as free public file hosting, enabling malware distribution, phishing payload staging, and reputational abuse of the HeyForm domain.

Affected Products

HeyForm versions prior to 3.0.0-rc.9
Self-hosted HeyForm deployments exposing /api/upload
Any HeyForm instance reachable from the network

Discovery Timeline

2026-07-20 - CVE-2026-63429 published to NVD
2026-07-22 - Last updated in NVD database

Technical Details for CVE-2026-63429

Vulnerability Analysis

The vulnerability stems from the shared use of POST /api/upload by two distinct user populations: authenticated form creators uploading assets, and unauthenticated form submitters attaching files to responses. To accommodate both, the endpoint was implemented without any access control. No NestJS guard, session validation, or form-context binding gates the request. As a result, every request to the endpoint is accepted regardless of origin or intent.

An attacker can script continuous uploads to consume storage, host arbitrary content on the HeyForm domain, or distribute payloads that inherit the target's domain reputation. Because the returned URLs are permanent and public, uploaded content persists until manually removed. The 10 MB per-file limit still permits meaningful malware, phishing kits, or illicit content to be hosted.

Root Cause

The root cause is the absence of authentication or contextual authorization on a file-write endpoint. Uploads intended to be tied to a specific form submission are never validated against an active form context or an openToken. This design conflates "public-facing" with "unauthenticated," removing the required binding between an upload and a legitimate form workflow.

Attack Vector

Exploitation requires only network access to the HeyForm instance. An attacker issues a multipart POST request to /api/upload with an arbitrary file and receives a permanent public URL in response. No user interaction, credentials, or form ID is required.

The upstream patch hardens related form security surfaces, including URL protocol sanitization to block javascript, vbscript, and data schemes in rendered content:

typescript

const UNSAFE_URL_PROTOCOLS = new Set(['javascript', 'vbscript', 'data'])
const URL_PROTOCOL_CONTROL_CHARS_REGEX = /[\\u0000-\\u001f\\u007f\s]+/g

export function isUnsafeUrlProtocol(value: unknown): boolean {
  const matched = String(value || '')
    .trimStart()
    .match(/^([^:]+):/)

  if (!matched) {
    return false
  }

  const protocol = matched[1]
    .replace(URL_PROTOCOL_CONTROL_CHARS_REGEX, '')
    .toLowerCase()
  return UNSAFE_URL_PROTOCOLS.has(protocol)
}

Source: HeyForm commit 092e255

Detection Methods for CVE-2026-63429

Indicators of Compromise

Unexpected files in HeyForm object storage lacking association with any submitted form
Sudden growth in upload storage volume or file count on the HeyForm host
Public URLs on the HeyForm domain serving executables, archives, or HTML phishing pages
Access logs showing repeated POST /api/upload requests from a single IP without prior form-render traffic

Detection Strategies

Audit web server and application logs for POST /api/upload calls that are not preceded by a GET on a form render endpoint
Compare uploaded object counts against the number of form submissions recorded in the database
Scan stored files for MIME types or content signatures inconsistent with expected form-attachment use

Monitoring Recommendations

Alert on high-rate upload activity from a single source IP or user agent
Monitor egress bandwidth to the HeyForm storage backend for anomalous spikes
Track newly created public URLs and correlate them with active form workflows

How to Mitigate CVE-2026-63429

Immediate Actions Required

Upgrade HeyForm to version 3.0.0-rc.9 or later without delay
Audit existing storage for unauthorized files uploaded before the patch was applied
Restrict inbound access to /api/upload at the reverse proxy layer if immediate patching is not possible

Patch Information

The fix is delivered in HeyForm 3.0.0-rc.9. Review the GitHub Security Advisory GHSA-432x-54v2-p7p7 and the upstream commit 092e255 for full remediation details.

Workarounds

Place /api/upload behind an authentication proxy or Web Application Firewall (WAF) rule that requires a valid session cookie
Enforce strict rate limits on the upload endpoint to reduce abuse potential
Block anonymous requests to /api/upload where a corresponding form-render session cannot be verified

bash

# Example nginx rule to require a session cookie for /api/upload
location = /api/upload {
    if ($cookie_session = "") {
        return 401;
    }
    limit_req zone=upload_zone burst=5 nodelay;
    proxy_pass http://heyform_backend;
}