CVE-2026-71553: ApostropheCMS: 2nd-order prototype pollution via PATCH leading to single-request persistent DoS

September 2, 2026 (updated October 28, 2026)

The vulnerability is a single-request persistent DoS by submitting e.g. “PATCH /api/v1/article/” with a valid editor session and body of {“toString.call”:“x”}, overwriting the global toString function with value x.

Fabian

References

github.com/advisories/GHSA-vmg4-6gfg-83qx
github.com/apostrophecms/apostrophe/commit/5a3746aaed49761e171c2cbfe793267c959829fd
github.com/apostrophecms/apostrophe/security/advisories/GHSA-vmg4-6gfg-83qx
nvd.nist.gov/vuln/detail/CVE-2026-71553

Code Behaviors & Features

Detect and mitigate CVE-2026-71553 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →