CVE-2026-113666: @apostrophecms/db-connect Authenticated Denial of Service via Prototype Member Deletion
Summary
CVE-2026-113666: @apostrophecms/db-connect ships an in-memory MongoDB emulation used by its SQLite, PostgreSQL, and multipostgres adapters. Affects @apostrophecms/db-connect versions < 1.1.0. Fixed in 1.1.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The @apostrophecms/db-connect package is a critical component of the ApostropheCMS framework, providing database connectivity through various adapters including SQLite and PostgreSQL. It facilitates the management of content in a structured manner, allowing users to create, read, update, and delete content types efficiently. However, a serious vulnerability has been identified that allows low-privileged authenticated users to exploit the package, leading to potential denial of service across the entire application.
Vulnerability Detail
The vulnerability arises from the unsetNestedField helper function within the @apostrophecms/db-connect package, which lacks proper validation for dotted field paths. An authenticated user with the view-draft permission can craft a malicious REST GET request that targets shared prototype methods, such as Object.prototype.hasOwnProperty. This results in the deletion of critical methods from the shared runtime, causing a process-wide denial of service until the Node process is restarted. The root cause is the failure to sanitize input paths, allowing untrusted input to mutate shared prototype objects.
How To Fix
Latest published version: 1.1.0 as of 22 Oct 2026
npm install @apostrophecms/db-connect@1.1.0The newest release already contains this fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As an interim workaround, consider using the default mongodb adapter, which is not affected by this vulnerability. Additionally, restrict authenticated API access to only fully trusted roles to prevent exploitation of the vulnerable endpoints.
Conclusion
The CVE-2026-113666 vulnerability in the @apostrophecms/db-connect package poses a significant risk to applications using this package. It allows authenticated users to exploit the system, leading to a denial of service. Immediate action is required to update the package to the patched version or implement workarounds to mitigate the risk.
See every vulnerability recorded for @apostrophecms/db-connect →
FAQ
CVE-2026-113666 is a vulnerability in the @apostrophecms/db-connect package that allows authenticated users to delete shared prototype methods, leading to a denial of service.
Any application using @apostrophecms/db-connect versions 1.0.0 to 1.0.2 with authenticated users holding the view-draft permission is at risk.
The vulnerability can lead to a persistent denial of service for all users and tenants of the application, as critical shared methods are deleted from the runtime.
You can use Vulert, which monitors open-source vulnerabilities in your software. By analyzing your package-lock.json file, Vulert can alert you in real-time about vulnerabilities. You can also check your application using the Vulert playground without signup.
The CVSS score for this vulnerability is 7.1, indicating a high severity level.
