{"id":"CVE-2026-71553","aliases":["GHSA-vmg4-6gfg-83qx"],"title":"ApostropheCMS: 2nd-order prototype pollution via PATCH leading to single-request persistent DoS","summary":"ApostropheCMS: 2nd-order prototype pollution via PATCH leading to single-request persistent DoS","severity":"high","cwe":["CWE-1321"],"vendor":"apostrophe","product":"apostrophe","ecosystem":"npm","affected":["apostrophe <= 4.32.0"],"published":"2026-09-02","updated":"2026-09-14","sourceUpdated":"2026-09-14T12:47:18Z","source":"GHSA","sourceUrl":"https://github.com/advisories/GHSA-vmg4-6gfg-83qx","references":[{"url":"https://github.com/apostrophecms/apostrophe/security/advisories/GHSA-vmg4-6gfg-83qx"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-71553"},{"url":"https://github.com/apostrophecms/apostrophe/commit/5a3746aaed49761e171c2cbfe793267c959829fd"},{"url":"https://github.com/advisories/GHSA-vmg4-6gfg-83qx"}],"tags":["ghsa","npm","nvd"],"epss":0.00312,"epssPercentile":0.24362,"ingestedAt":"2026-09-02T15:46:29.619Z","slug":"CVE-2026-71553","body":"## Overview\n\nThe vulnerability is a single-request persistent DoS by submitting e.g.\n\"PATCH /api/v1/article/<id>\" with a valid editor session and body of\n{\"toString.call\":\"x\"}, overwriting the global toString function with\nvalue x.\n\nFabian\n\n## Affected packages\n\n- `apostrophe <= 4.32.0`\n\n## Remediation\n\nRefer to the advisory for the patched release.","depth":"twilight","depthScore":41,"depthScoreParts":{"impact":41.3,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}