In sanitize-html 2.18.0, an <iframe> tag that is not allowed is discarded, and its raw text is re‑sanitized by a recursive call to sanitizeHtml. Each recursive call starts with a fresh state and has no bound, creating an unbounded recursion that eventually causes a stack overflow. The effect is a denial of service because the Node.js process crashes when the recursion depth exceeds the system stack.

The vulnerability occurs in ApostropheCMS, specifically in the sanitize-html module version 2.18.0 that is bundled with the apostrophecms:apostrophe and apostrophecms:sanitize-html packages. Version 2.18.1 and later contain the fix and are not affected.

The CVSS score of 5.3 indicates moderate severity, and the vulnerability is not listed in the CISA KEV catalog. The EPSS score is less than 1%, implying a very low but non‑zero likelihood of exploitation. An attacker appears to need the ability to supply or manipulate content that contains an iframe tag, such as through the CMS editor or API. When that content is processed, the recursive sanitization will exhaust the stack and terminate the application, resulting in a denial of service. No other direct exploitation vectors are described in the available information.