EUVD-2026-60442
GHSA-vmg4-6gfg-83qx
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable REST API exploitable with only an editor session (PR:L); a single request causes persistent high-availability impact via process-wide prototype corruption, with no confidentiality impact.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
3DescriptionCVE.org
ApostropheCMS is an open-source Node.js content management system. In 4.32.0 and earlier, PATCH /api/v1/article/:id accepts the inherited path toString.call and passes it through the utility module to apos.util.set() and apos.util.get(), allowing an authenticated editor to overwrite the shared Object.prototype.toString function's call property and cause a persistent process-wide denial of service until restart.
Articles & Coverage 1
AnalysisAI
Prototype pollution in ApostropheCMS 4.32.0 and earlier enables an authenticated editor to trigger a persistent, process-wide denial of service via a single PATCH REST API request. By sending { "toString.call": "x" } to PATCH /api/v1/article/:id, the attacker walks the JavaScript prototype chain through apos.util.set() into the shared Object.prototype.toString function object and shadows its call method, breaking every subsequent Object.prototype.toString.call() invocation in Node.js - including those inside the MongoDB driver - until the server process is manually restarted. No separate proof-of-concept repository has been published, but the exact attack payload is fully disclosed in the public GitHub security advisory GHSA-vmg4-6gfg-83qx and the upstream commit diff, and active exploitation has not been confirmed by CISA KEV.
Technical ContextAI
ApostropheCMS is an open-source Node.js content management system (CPE: cpe:2.3:a:apostrophecms:apostrophe:*:*:*:*:*:*:*:*) whose REST API exposes PATCH endpoints for editing content pieces. The vulnerability is classified as CWE-1321 (Improperly Controlled Modification of Object Prototype Attributes - prototype pollution). The apos.util.set() and apos.util.get() utility functions accept dot-notation key paths extracted from REST API request bodies and resolve them property-by-property. The previous blocklist approach denied only the well-known dangerous segments __proto__, constructor, and prototype, but failed to account for the fact that every plain JavaScript object inherits properties from Object.prototype - such as toString, valueOf, and hasOwnProperty. A dot path like toString.call walks to Object.prototype.toString, a single function object shared across the entire Node.js process, and writes an arbitrary value to its call property. The fix introduces an ownProperty() helper using Object.hasOwn() that restricts traversal to own (non-inherited) properties only, confining dot paths to the data structures of the request body and the document being patched.
RemediationAI
The upstream fix is present in commit 5a3746aaed49761e171c2cbfe793267c959829fd (https://github.com/apostrophecms/apostrophe/commit/5a3746aaed49761e171c2cbfe793267c959829fd); however, the specific npm package version incorporating this patch is not stated in the available data and was not independently confirmed - organizations should consult the npm registry and the advisory at https://github.com/apostrophecms/apostrophe/security/advisories/GHSA-vmg4-6gfg-83qx for the definitive patched release and upgrade to it immediately. If upgrading is not immediately possible, restricting PATCH API access at the reverse proxy or WAF layer to trusted, known-IP sources reduces exposure to externally compromised editor accounts, though it does not protect against insider threats. Disabling the REST API entirely eliminates the attack surface at the cost of all API-dependent integrations and headless front-end functionality. Rate-limiting PATCH endpoints provides no meaningful protection since a single request is sufficient to cause persistent DoS.
A vulnerability in the NuPoint Unified Messaging (NPM) component of Mitel MiCollab through 9.8 SP1 FP2 (9.8.1.201) could
FortiOS and FortiProxy contain an authentication bypass via the Node.js websocket module allowing unauthenticated remote
Denial of service against HTTP/2 server implementations allows remote unauthenticated attackers to exhaust server resour
Eval injection vulnerability in the internals.batch function in lib/batch.js in the bassmaster plugin before 1.5.2 for t
Flowise version 3.0.5 contains a remote code execution vulnerability in the CustomMCP node. The mcpServerConfig paramete
Node.js 8.5.0 before 8.6.0 allows remote attackers to access unintended files, because a change to ".." handling was inc
An issue was discovered in the node-serialize package 0.0.4 for Node.js. Rated critical severity (CVSS 9.8), this vulner
OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h does not properly restrict processing of ChangeCiph
Directory traversal vulnerability in the st module before 0.2.5 for Node.js allows remote attackers to read arbitrary fi
Multiple SQL injection vulnerabilities in the Manage Accounts page in the AccountManagement.asmx service in the Solarwin
The JS-YAML module before 2.0.5 for Node.js parses input without properly considering the unsafe !!js/function tag, whic
The AES-NI implementation in OpenSSL before 1.0.1t and 1.0.2 before 1.0.2h does not consider memory allocation during a
Same technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today