CVE-2026-71553: ApostropheCMS: 2nd-order prototype pollution via PATCH leading to single-request persistent DoS

September 2, 2026

The vulnerability is a single-request persistent DoS by submitting e.g. “PATCH /api/v1/article/” with a valid editor session and body of {“toString.call”:“x”}, overwriting the global toString function with value x.

Fabian

References

github.com/advisories/GHSA-vmg4-6gfg-83qx
github.com/apostrophecms/apostrophe/commit/5a3746aaed49761e171c2cbfe793267c959829fd
github.com/apostrophecms/apostrophe/security/advisories/GHSA-vmg4-6gfg-83qx
nvd.nist.gov/vuln/detail/CVE-2026-71553

Code Behaviors & Features

Detect and mitigate CVE-2026-71553 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →