{"id":"CVE-2026-71553","kind":"vulnerability","aliases":["CVE-2026-71553","GHSA-vmg4-6gfg-83qx"],"related":[],"title":"ApostropheCMS: 2nd-order prototype pollution via PATCH leading to single-request persistent DoS","description":"ApostropheCMS is an open-source Node.js content management system. In 4.32.0 and earlier, PATCH /api/v1/article/:id accepts the inherited path toString.call and passes it through the utility module to apos.util.set() and apos.util.get(), allowing an authenticated editor to overwrite the shared Object.prototype.toString function's call property and cause a persistent process-wide denial of service until restart.","summary":"A crafted PATCH request to an ApostropheCMS article endpoint overwrites the global toString function through prototype pollution, so a single request can persistently break the application. The sources describe this as denial of service, not code execution.","severity":"high","cvss":7.1,"epss":0.00429,"exploited":false,"exploited_at":null,"products":[{"name":"apostrophe","fixed":["4.32.1"],"affected":"<= 4.32.0","ecosystem":"npm"}],"ecosystems":["npm"],"tags":["apostrophe","cwe-1321","node.js","package","self-hosted"],"not_affected_if":["auth-required","fixed-version"],"how_to_check":"- Check the installed version with `npm ls apostrophe` and see whether it is `4.32.0` or lower.\n- Review whether editor accounts can send PATCH requests to `/api/v1/article/<id>` from untrusted input.","fix":"- Upgrade `apostrophe` to `4.32.1`.","status":"open","published_at":"2026-08-17T20:16:46+00:00","first_seen_at":"2026-10-28T15:14:20+00:00","triaged_at":"2026-10-28T15:16:23+00:00","updated_at":"2026-10-28T15:33:37+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-10-28T15:16:23Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade `apostrophe` to `4.32.1`.","reach":"internet","title":"ApostropheCMS: PATCH request pollutes prototype and persistently breaks the server","impact":"medium","summary":"A crafted PATCH request to an ApostropheCMS article endpoint overwrites the global toString function through prototype pollution, so a single request can persistently break the application. The sources describe this as denial of service, not code execution.","category":"package","nicknames":[],"who_cares":["apostrophe","node.js","self-hosted"],"confidence":0.8,"needs_auth":"yes","worst_case":"Server persistently broken by one request; denial of service","analyst_note":"","how_to_check":"- Check the installed version with `npm ls apostrophe` and see whether it is `4.32.0` or lower.\n- Review whether editor accounts can send PATCH requests to `/api/v1/article/<id>` from untrusted input.","needs_analyst":false,"not_affected_if":["fixed-version","auth-required"],"who_is_affected":"Sites running the apostrophe npm package at version 4.32.0 or earlier are affected. The attack needs a valid editor session, so sites where only trusted staff can log in as editors face less exposure. Sites on 4.32.1 or later are not affected.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000576,"input_tokens":3353,"output_tokens":481,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-1321':30B '-2026':17A,25A '-71553':18A,26A '/api/v1/article':88C '2nd':3A '2nd-order':2A '4.32.0':84C '6gfg':22A '83qx':23A 'accept':90C 'allow':106C 'apos.util.get':105C 'apos.util.set':103C 'apostroph':28B 'apostrophe':27A 'apostrophecm':1A,42B,73C 'applic':61B 'articl':43B 'authent':108C 'break':59B 'call':117C 'caus':120C 'code':71B 'content':80C 'craft':37B 'cve':16A,24A 'cwe':29B 'denial':67B,126C 'describ':64B 'dos':15A 'earlier':86C 'editor':109C 'endpoint':44B 'execut':72B 'function':49B,115C 'ghsa':20A 'ghsa-vmg4-6gfg-83qx':19A 'global':47B 'host':35B 'id':89C 'inherit':92C 'lead':9A 'manag':81C 'modul':101C 'node.js':31B,79C 'object.prototype.tostring':114C 'open':77C 'open-sourc':76C 'order':4A 'overwrit':45B,111C 'packag':32B 'pass':96C 'patch':8A,38B,87C 'path':93C 'persist':14A,58B,122C 'pollut':6A,52B 'process':124C 'process-wid':123C 'properti':118C 'prototyp':5A,51B 'request':13A,39B,56B 'restart':130C 'self':34B 'self-host':33B 'servic':69B,128C 'share':113C 'singl':12A,55B 'single-request':11A 'sourc':63B,78C 'system':82C 'tostr':48B 'tostring.call':94C 'util':100C 'via':7A 'vmg4':21A 'wide':125C","nicknames":[],"mitigations":[],"who_affected":"Sites running the apostrophe npm package at version 4.32.0 or earlier are affected. The attack needs a valid editor session, so sites where only trusted staff can log in as editors face less exposure. Sites on 4.32.1 or later are not affected.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-08-17T20:16:46+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"ghsa","external_id":"GHSA-vmg4-6gfg-83qx","url":"https://github.com/advisories/GHSA-vmg4-6gfg-83qx","severity":"high","published_at":"2026-09-02T15:12:41+00:00","modified_at":"2026-10-28T15:12:57+00:00","first_seen_at":"2026-10-28T15:14:20+00:00","fetched_at":"2026-10-28T15:19:34+00:00","note":null},{"source":"nvd","external_id":"CVE-2026-71553","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-71553","severity":null,"published_at":"2026-08-17T20:16:46+00:00","modified_at":"2026-10-23T16:10:00+00:00","first_seen_at":"2026-10-28T15:33:37+00:00","fetched_at":"2026-10-28T15:33:37+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}