7.1
High
CVE-2026-71553 ApostropheCMS is an open-source Node.js content management system
Description
ApostropheCMS is an open-source Node.js content management system. In 4.32.0 and earlier, PATCH /api/v1/article/:id accepts the inherited path toString.call and passes it through the utility module to apos.util.set() and apos.util.get(), allowing an authenticated editor to overwrite the shared Object.prototype.toString function's call property and cause a persistent process-wide denial of service until restart.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| apostrophe 4.32 | earliest → 4.32.0 | No fix stated |
References
- github.com github.com
- github.com github.com
Timeline
- Published
- Last modified
Other CVEs of apostrophe
The 51 CVEs of apostrophe →
CVE-2026-113711
ApostropheCMS is an open-source Node.js content management system
7.5
High
CVE-2026-113710
ApostropheCMS is an open-source Node.js content management system
5.9
Medium
CVE-2026-113671
ApostropheCMS is an open-source Node.js content management system
4.3
Medium
CVE-2026-113670
ApostropheCMS is an open-source Node.js content management system
5.3
Medium