CVE-2026-82291: HeyForm CSRF Vulnerability in CORS Headers

CVE-2026-82291 Overview

CVE-2026-82291 is a Cross-Origin Resource Sharing (CORS) misconfiguration in HeyForm, an open-source form builder. Versions before 3.0.0-rc.8 reflect the request Origin header in CORS responses while setting Access-Control-Allow-Credentials: true. This combination allows any origin to send authenticated requests to the HeyForm backend using a logged-in user's session cookies. Attackers can lure authenticated users to malicious pages and execute GraphQL queries against HeyForm on their behalf. The vulnerability is categorized under CWE-942: Permissive Cross-domain Policy with Untrusted Domains.

Critical Impact
Attackers can read workspaces, projects, forms, submissions, and respondent data, and modify account settings of any HeyForm user who visits an attacker-controlled page while authenticated.

Affected Products

HeyForm versions prior to 3.0.0-rc.8
HeyForm server component (packages/server)
Self-hosted HeyForm deployments using default CORS configuration

Discovery Timeline

2026-08-28 - CVE-2026-82291 published to NVD
2026-08-31 - Last updated in NVD database

Technical Details for CVE-2026-82291

Vulnerability Analysis

HeyForm's NestJS server configures CORS by echoing back whatever value the client sends in the Origin request header. The server simultaneously enables credentialed cross-origin requests. Browsers normally block cross-origin requests that carry cookies unless the server explicitly opts in with Access-Control-Allow-Credentials: true and a specific matching origin. By reflecting arbitrary origins, HeyForm removes the same-origin barrier for its GraphQL API.

An attacker hosting a page on any domain can issue fetch calls with credentials: 'include' to the HeyForm backend. The victim's browser attaches session cookies. HeyForm responds with the attacker's origin echoed and credentials allowed, so the browser hands the response body to the attacker's JavaScript. All authenticated GraphQL operations become reachable, including queries for workspaces, projects, forms, submissions, respondent PII, and mutations against account settings.

Root Cause

The root cause is a permissive CORS policy without an allowlist. The pre-patch server initialization in packages/server/src/main.ts did not restrict the set of origins permitted to send credentialed requests. Any request Origin header was accepted, negating the trust boundary that CORS is designed to enforce.

Attack Vector

Exploitation requires network reachability to the HeyForm instance and user interaction: the target must visit a malicious page while logged in to HeyForm. No privileges are required from the attacker. The attack succeeds silently from the user's perspective because the malicious requests run in the background of the attacker's page.

typescript

// Security patch in packages/server/src/config/cors/index.ts
// fix(security): restrict credentialed CORS origins
import { CORS_ALLOWED_ORIGINS } from '@environments'

type CorsOriginCallback = (err: Error | null, allow?: boolean) => void

export function normalizeCorsOrigin(origin?: string): string | undefined {
  const value = origin?.trim()

  if (!value) {
    return
  }

  try {
    return new URL(value).origin
  } catch (_) {
    return
  }
}

export function normalizeCorsAllowedOrigins(origins: string[]): string[] {
  return Array.from(new Set(origins.map(normalizeCorsOrigin).filter(Boolean) as string[]))
}

export function isCorsOriginAllowed(
  origin: string | undefined,
  allowedOrigins = CORS_ALLOWED_ORIGINS
): boolean {
  const requestOrigin = normalizeCorsOrigin(origin)

  if (!requestOrigin) {
    return false

Source: HeyForm commit bf9d738. The patch introduces an explicit allowlist keyed to the CORS_ALLOWED_ORIGINS environment variable and normalizes origins before comparison.

Detection Methods for CVE-2026-82291

Indicators of Compromise

HTTP responses from the HeyForm backend containing Access-Control-Allow-Origin values that match arbitrary or externally-controlled domains alongside Access-Control-Allow-Credentials: true.
Authenticated GraphQL POST requests to /graphql with a Referer or Origin header pointing to a domain outside the organization's approved list.
Bursts of successful GraphQL queries reading workspaces, projects, forms, or submissions from a single session in rapid succession following a user navigating to an external link.

Detection Strategies

Inspect reverse proxy or CDN logs for HeyForm API requests where the Origin header does not match APP_HOMEPAGE_URL or the configured dashboard domain.
Alert on GraphQL query patterns that exfiltrate bulk respondent data outside of interactive dashboard workflows.
Baseline expected browser origins per user session and flag deviations against the HeyForm GraphQL endpoint.

Monitoring Recommendations

Enable verbose access logging on the HeyForm server and forward logs to a centralized analytics platform for correlation.
Monitor for unexpected Set-Cookie or session reuse patterns tied to cross-origin GraphQL activity.
Track outbound network calls from user browsers to the HeyForm API when the referrer is not the sanctioned dashboard URL.

How to Mitigate CVE-2026-82291

Immediate Actions Required

Upgrade HeyForm to version 3.0.0-rc.8 or later, which introduces an explicit CORS allowlist.
Set the CORS_ALLOWED_ORIGINS environment variable to the exact dashboard origin(s) used by your deployment.
Invalidate active user sessions after upgrading to force reauthentication and clear any long-lived cookies that may have been abused.
Audit recent GraphQL activity for cross-origin queries against sensitive workspace and submission data.

Patch Information

The fix is delivered in commit bf9d738ca70ae5641c0c7372982b00365c5144d4 and documented in GitHub Security Advisory GHSA-fg7j-rmgr-rc9g. Additional context is available in the VulnCheck advisory. The patch replaces origin reflection with an allowlist check via isCorsOriginAllowed and normalization through normalizeCorsOrigin.

Workarounds

Front the HeyForm server with a reverse proxy that overrides the Access-Control-Allow-Origin header to a static, trusted value and strips credentialed CORS responses for unknown origins.
Deploy HeyForm behind a network boundary that restricts access to authenticated users on approved networks, reducing the pool of victims who can be targeted from arbitrary pages.
Instruct users to log out of HeyForm when not actively using it, minimizing the window during which reflected CORS requests carry valid session cookies.

bash

# Configuration example: restrict credentialed CORS to the dashboard origin
# packages/server/.env
APP_HOMEPAGE_URL=https://forms.example.com
CORS_ALLOWED_ORIGINS=https://forms.example.com

# Multiple trusted origins can be comma-separated
# CORS_ALLOWED_ORIGINS=https://forms.example.com,https://admin.example.com

Source: HeyForm .env.example patch. The new CORS_ALLOWED_ORIGINS variable defaults to APP_HOMEPAGE_URL when omitted.