VulertSecurity VulertSecurity

Vulnerability Database · npm · apostrophe · Version

apostrophe 3.66.0

3.66.0 is affected by 29 vulnerabilities.

The vulnerabilities that cover this exact version are listed below with the fixed version to move to. The upgrade Vulert recommends: 4.34.0.

Critical 1 High 8 Medium 17 Low 3 Unrated 0

All apostrophe versions & vulnerabilities → Source repository Search the database for this package →
Released 15 May 2024 Licence MIT Also known from other sources 30 Newer releases 300 Database updated 23/Oct/2026

Release and licence data published by the npm registry. Licence information is not legal advice.

Concerned about your application's security?

Vulert continues monitoring your dependencies and alerts you when new vulnerabilities are disclosed. No installation and no source-code access required.

01 Vulnerabilities affecting this version

apostrophe 3.66.0 vulnerabilities

29 vulnerabilities cover apostrophe 3.66.0. Scroll the table for all of them, or open the full list in the database.

Vulnerability Severity Fixed version Disclosed
CVE-2026-53609: ApostropheCMS Server-Side Prototype Pollution Leading to Authorization Bypass 9.1 critical 4.31.0 31 Jul 2026
CVE-2026-35569: ApostropheCMS Stored XSS Vulnerability in SEO Fields 8.7 high 4.29.0 16 Apr 2026
CVE-2026-45013: ApostropheCMS Weak Password Recovery Mechanism and Input Validation Flaw 8.1 high No fix published 14 May 2026
CVE-2026-32730: ApostropheCMS MFA/TOTP Bypass via Incorrect MongoDB Query in Bearer Token Middleware 8.1 high 4.28.0 18 Mar 2026
CVE-2026-45012: ApostropheCMS Authenticated SSRF in Rich-Text Widget Import 7.6 high No fix published 14 May 2026
CVE-2026-113711: ApostropheCMS Unauthenticated Resource Exhaustion via Pre-auth AposBigUpload Processing 7.5 high 4.33.0 21 Oct 2026
CVE-2026-113658: ApostropheCMS Unauthenticated CSV Import Vulnerability Leading to Disk Space Exhaustion 7.5 high 4.33.0 20 Oct 2026
CVE-2026-45011: ApostropheCMS Stored XSS via javascript: URL in Image Widget Link 7.3 high No fix published 14 May 2026
CVE-2026-71553: ApostropheCMS 2nd-order Prototype Pollution Leading to Persistent DoS 7.1 high No fix published 02 Sep 2026
CVE-2026-113653: ApostropheCMS User Object Exposure Vulnerability 6.9 medium 4.33.0 20 Oct 2026
ApostropheCMS: Missing destination-parent authorization in page `move()` allows a low-privileged editor to move and re-rank pages inside a restricted subtree 6.5 medium 4.32.0 03 Sep 2026
CVE-2026-113659: ApostropheCMS Client-side Prototype Pollution Leading to DOM-based XSS 6.1 medium 4.33.0 20 Oct 2026
CVE-2026-113710: ApostropheCMS Password Change Endpoint Lacks Throttling Mechanism 5.9 medium 4.33.0 20 Oct 2026
CVE-2026-112958: ApostropheCMS Stored XSS via Unescaped Widget Style Attribute Serialization 5.4 medium 4.34.0 21 Oct 2026
CVE-2026-112951: ApostropheCMS Color Field Validation Bypass Leading to Stored XSS 5.4 medium 4.34.0 21 Oct 2026
CVE-2026-33889: ApostropheCMS Stored XSS via CSS Custom Property Injection 5.4 medium 4.29.0 16 Apr 2026
CVE-2026-112954: ApostropheCMS Unauthenticated API Bypass via Search and Sort Queries 5.3 medium 4.34.0 21 Oct 2026
CVE-2026-113668: ApostropheCMS Locales Route Authorization Bypass Vulnerability 5.3 medium 4.33.0 20 Oct 2026
CVE-2026-110904: ApostropheCMS Page REST API Authorization Bypass Vulnerability 5.3 medium 4.33.0 20 Oct 2026
CVE-2026-113669: ApostropheCMS Cross-domain Session Token Vulnerability Leading to Session Takeover 5.3 medium 4.33.0 20 Oct 2026
CVE-2026-39857: ApostropheCMS Information Disclosure via Query Parameter Bypass 5.3 medium 4.29.0 16 Apr 2026
CVE-2026-33888: ApostropheCMS Public API Projection Bypass Vulnerability 5.3 medium 4.29.0 16 Apr 2026
CVE-2026-112952: ApostropheCMS Information Disclosure via Slug Enumeration 4.3 medium 4.34.0 21 Oct 2026
CVE-2026-112957: ApostropheCMS Page API Bypass Vulnerability Exposes Sensitive Data 4.3 medium 4.34.0 21 Oct 2026
CVE-2026-113660: ApostropheCMS Authenticated Object-Level Authorization Bypass in exist-in-locale 4.3 medium 4.33.0 20 Oct 2026
CVE-2026-113655: ApostropheCMS Same-Parent Page Reorder Vulnerability 4.3 medium 4.33.0 20 Oct 2026
CVE-2026-113665: ApostropheCMS Notification Module Lacks Authorization on PATCH/DELETE Endpoints 3.7 low 4.33.0 20 Oct 2026
CVE-2026-53607: @apostrophecms/file Unauthenticated SSRF via Host Header 3.7 low 4.31.0 31 Jul 2026
CVE-2026-33877: ApostropheCMS User Enumeration via Timing Side Channel in Password Reset Endpoint 3.7 low 4.29.0 16 Apr 2026

Looking for another version, or everything Vulert holds for apostrophe?

All versions → Full vulnerability list →

Subscribe to Vulert on Telegram
Daily digest of new CVEs, critical and high severity, affected packages and fixes — plus a weekly roundup.
Join the channel →

Questions

About apostrophe 3.66.0

Is apostrophe 3.66.0 vulnerable?

Yes. 29 vulnerabilities in the Vulert database cover apostrophe 3.66.0: 1 critical, 8 high, 17 medium and 3 low. The upgrade Vulert recommends is 4.34.0, and each entry above names the fixed version to move to.

Which version of apostrophe should I use instead of 3.66.0?

4.34.0 is the version Vulert recommends for this release line. The version table on the package page lists every release with the vulnerabilities recorded against it.

Is 3.66.0 the latest release of apostrophe?

No. 3.66.0 was published 15 May 2024, and newer releases exist. Newer is not automatically safer — the version table on the package page shows what each release carries.

How do I monitor apostrophe for upcoming vulnerabilities?

Upload the manifest or SBOM for your application at vulert.com/scanner and Vulert keeps checking the apostrophe version you actually run against new disclosures, then alerts you when one affects it. There is no installation and no source-code access required.