Live › vulnerability › CVE-2026-71553
Go to dashboardA crafted PATCH request to an ApostropheCMS article endpoint overwrites the global toString function through prototype pollution, so a single request can persistently break the application. The sources describe this as denial of service, not code execution.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-28 15:14 UTC, 0h before NVD. All times on this page are UTC.
Sites running the apostrophe npm package at version 4.32.0 or earlier are affected. The attack needs a valid editor session, so sites where only trusted staff can log in as editors face less exposure. Sites on 4.32.1 or later are not affected.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| apostrophe | npm | <= 4.32.0 | 4.32.1 |
npm ls apostrophe and see whether it is 4.32.0 or lower./api/v1/article/<id> from untrusted input.apostrophe to 4.32.1.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
ApostropheCMS is an open-source Node.js content management system. In 4.32.0 and earlier, PATCH /api/v1/article/:id accepts the inherited path toString.call and passes it through the utility module to apos.util.set() and apos.util.get(), allowing an authenticated editor to overwrite the shared Object.prototype.toString function's call property and cause a persistent process-wide denial of service until restart.
This page as .md · .json · in your agent: get_signal("CVE-2026-71553")
GitHub Advisory Database, CC-BY 4.0 · NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.