CVE-2026-71553
Received Received - Intake

Prototype Pollution in ApostropheCMS Leading to DoS

Publication date: 2026-08-17

Last updated on: 2026-08-17

Assigner: GitHub, Inc.

Description
ApostropheCMS is an open-source Node.js content management system. In 4.32.0 and earlier, PATCH /api/v1/article/:id accepts the inherited path toString.call and passes it through the utility module to apos.util.set() and apos.util.get(), allowing an authenticated editor to overwrite the shared Object.prototype.toString function's call property and cause a persistent process-wide denial of service until restart.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-17
Last Modified
2026-08-17
Generated
2026-08-18
AI Q&A
2026-08-17
EPSS Evaluated
N/A
NVD
CVE-2026-71553
EUVD
EUVD-2026-60442

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
apostrophecms apostrophe to 4.33.0 (exc)
apostrophecms apostrophe From 4.32.0 (inc)
apostrophecms apostrophe to 4.32.0 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-1321 The product receives input from an upstream component that specifies attributes that are to be initialized or updated in an object, but it does not properly control modifications of attributes of the object prototype.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a server-side prototype pollution vulnerability in ApostropheCMS. An authenticated editor can send a crafted PATCH request with a path like { "toString.call": "x" } to overwrite the global Object.prototype.toString function. This causes a persistent denial-of-service (DoS) condition by corrupting shared prototype methods used by the application and dependencies like MongoDB driver.

Detection Guidance

Check ApostropheCMS version with npm list apostrophe or grep package.json. Monitor for crashes in Node.js processes. Inspect logs for PATCH requests to /api/v1/article/:id with suspicious payloads like {"toString.call":"x"}.

Impact Analysis

An attacker with editor access could crash the entire application with a single request. The DoS persists until the process restarts, disrupting service for all users. It may also lead to data corruption or unintended behavior in dependent modules.

Compliance Impact

This vulnerability could lead to a persistent denial-of-service (DoS) condition, crashing the application until restart. For GDPR, this may impact availability of personal data processing systems, potentially violating Article 32 requirements for resilience. For HIPAA, it could disrupt access to protected health information systems, affecting availability requirements under the Security Rule.

Mitigation Strategies

Upgrade ApostropheCMS to version 4.33.0 or higher immediately. Restart affected Node.js processes to clear any existing prototype pollution. Review editor permissions to limit access to PATCH endpoints.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-71553. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart