CVE-2026-71553: ApostropheCMS is an open-source Node.js content management system. In 4.32.0 and earlier, PATCH /api/v1/article/:id acce…
ApostropheCMS is an open-source Node.js content management system. In 4.32.0 and earlier, PATCH /api/v1/article/:id accepts the inherited path toString.call and passes it through the utility module to apos.util.set() and apos.util.get(), allowing an authenticated editor to overwrite the shared Object.prototype.toString function's call property and cause a persistent process-wide denial of service until restart.
- Published by source
- 2026-08-17
- First seen by Reality Radar
- 2026-10-23
- Last verified
- 2026-10-23
What the official notice says
Risk: CVSS 7.1
Is this affecting you?
Add what you own or use and Reality Radar will tell you when official changes match it — with evidence and next steps.
Sources
- NIST National Vulnerability Database Tier A · official published 2026-08-17
Evidence ledger
Every piece of evidence we store is appended to a public hash chain, so later edits are detectable. Anyone can re-verify it.
| Entry | Kind | Observed | Evidence hash | Entry hash |
|---|---|---|---|---|
| #1308 | new | 2026-10-23 | 5eb0bf0c59d6…f9978d | ed3353b74a48…81772f |
Chain head: #1479 ad3417dbc128…777bd4