CVE-2026-71553: ApostropheCMS 2nd-order Prototype Pollution Leading to Persistent DoS
Summary
CVE-2026-71553: ApostropheCMS: 2nd-order prototype pollution via PATCH leading to single-request persistent DoS. Affects apostrophe versions < 4.32.0. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
ApostropheCMS is a powerful open-source content management system (CMS) built on Node.js, designed to help developers create and manage websites easily. It offers features such as in-context editing, a flexible content model, and a robust plugin architecture. However, it is susceptible to a critical vulnerability that allows for prototype pollution, which can lead to denial of service (DoS) attacks.
Vulnerability Detail
The vulnerability arises from a flaw in the handling of PATCH requests to the API endpoint '/api/v1/article/<id>'. By submitting a specially crafted request with a body containing {"toString.call":"x"}, an attacker can overwrite the global toString function, effectively causing the application to behave unexpectedly. This can lead to a single-request persistent DoS, where the application becomes unresponsive due to the altered global function. The vulnerability is classified under CWE-1321, indicating a significant risk to the integrity and availability of the application.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, you can implement input validation on the API endpoint to reject any PATCH requests that contain unexpected payloads. This can help mitigate the risk until a proper update is applied. For example, you can check the request body before processing it:
if (req.body && req.body.toString && req.body.toString.call !== expectedValue) {
return res.status(400).send('Invalid request body');
}
Conclusion
In summary, CVE-2026-71553 is a critical vulnerability in ApostropheCMS that allows for prototype pollution through malicious PATCH requests, leading to potential denial of service. It is essential to update to the latest version to mitigate this risk and implement temporary workarounds if necessary.
See every vulnerability recorded for apostrophe →
FAQ
The CVSS score of this vulnerability is 7.1, indicating a high severity level.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
If you cannot update the package right away, implement input validation as a temporary workaround to mitigate the risk.
Yes, the vulnerability affects all versions of ApostropheCMS up to and including 4.32.0.
You can find more details on the GitHub advisory database or by visiting the ApostropheCMS documentation.
References
Related vulnerabilities
Recent vulnerabilities recorded for apostrophe.
