CVE-2026-71553
ApostropheCMS is an open-source Node.js content management system. In 4.32.0 and earlier, PATCH /api/v1/article/:id accepts the inherited path toString.call and passes it through the utility module to apos.util.set() and apos.util.get(), allowing an authenticated editor to overwrite the shared Object.prototype.toString function's call property and cause a persistent process-wide denial of service until restart.
Scoring
- Severity
- HIGH
- CVSS base score
- 7.1
- CVSS vector
- CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N
- EPSS probability
- 0.31%
- CWE
- CWE-1321
- Published
- 2026-08-17
- Last modified
- 2026-08-17
Affected products
- apostrophecms apostrophe
Weakness type
Related vulnerabilities
- CVE-2026-89011 — isomorphic-git < 1.42.0 Prototype Pollution via getRemoteInfo
- CVE-2026-86078 — n8n: Prototype Pollution via Workflow Structure Summary Can Lead to Denial of Service
- CVE-2026-81994 — Acrobat Reader | Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') (CWE-1321)
- CVE-2026-85625 — sift 17.1.3 Prototype Pollution Remote Code Execution via $where
- CVE-2026-63376 — toml-node: Prototype Pollution Leads to `Object.prototype` Corruption via `__proto__` Key-Path Desynchronization
- CVE-2026-85063 — node-csv: Prototype replacement still reachable via columns path
- CVE-2026-82404 — TOON: Prototype pollution when decoding untrusted TOON input
- CVE-2026-84368 — joi: Prototype pollution via a `__proto__` language key in custom messages