Apostrophe CMS Prototype Pollution Causes Persistent Denial of Service

The open-source content management system Apostrophe has released patches for a high-severity prototype pollution vulnerability. The flaw, tracked as CVE-2026-113666, impacts the npm packages @apostrophecms/db-connect and apostrophe. Versions of @apostrophecms/db-connect prior to 1.1.0 and apostrophe versions before 4.33.0 are vulnerable. Users running these older versions must update immediately to mitigate the risk of service disruption.

How it unfolded

• The vulnerability exists in the @apostrophecms/db-connect package, which provides an in-memory MongoDB emulation for SQLite, PostgreSQL, and multipostgres adapters.
• The core issue lies in the unsetNestedField helper, which processes attacker-controlled dotted field paths without validating segments before deleting properties.
• Attackers can exploit this by sending a piece-type REST GET request with a specific exclusion key in the project query builder, such as constructor.prototype.hasOwnProperty.

Who is affected

Any system using the affected npm packages is at risk. The vulnerability is accessible to low-privileged authenticated users who hold the view-draft role, a permission granted to every editor and contributor. If the guestApiAccess setting is enabled, any logged-in user can trigger the flaw. The attack vector targets the projection query builder, which fails to sanitize projection keys, allowing arbitrary dotted keys to reach the database layer.

Our take on the response

The technical root cause involves the applyProjection function on SQLite and PostgreSQL adapters. When an exclusion projection is applied, it calls unsetNestedField, which splits the field on dots and walks the segments without guards. Unlike its sibling function, it does not block literal __proto__, constructor, or prototype. This allows an attacker to resolve Object.prototype and delete a shared runtime method, breaking request handling for every tenant and user in the Node process until it is restarted.

Who needs to act first

Managed service providers should prioritize updating public-facing Apostrophe instances immediately. Teams usually begin by identifying all environments running the vulnerable npm packages. Roll out the patches to staging environments first to verify compatibility with custom modules. Back up databases and configuration files before applying updates. If immediate patching is not possible, restrict access to the view-draft role and disable guestApiAccess to reduce the attack surface while preparing the maintenance window.

Background: Attack vectors

Attack vectors are the paths adversaries use to reach your data. They range from simple phishing emails to complex supply chain compromises. Defending against them requires mapping every entry point, validating inputs, and limiting what each component can do. You cannot stop all attacks, but you can make them costly and slow.

Read the full guide: Attack Vectors Explained: Mechanisms, Limits, and Defense Strategies

What to do and how to stay safe: Apostrophe CMS

• Update @apostrophecms/db-connect to version 1.1.0 or later on all affected servers.
• Upgrade the apostrophe npm package to version 4.33.0 or later to close the vulnerability.
• Monitor server logs for unusual REST GET requests containing complex dotted exclusion keys in the project query builder.
• Restart Node processes if a denial of service has already occurred, as the damage persists until the process is cycled.

Step-by-step guide: Vulnerability Prioritization: How to Rank Risks Without Wasting Time

General security guidance from the Patch Observer newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What is the severity of CVE-2026-113666?

The vulnerability is rated as high severity according to the GitHub advisory GHSA-j5rq-xfvr-p969.

Who can exploit this vulnerability?

Any authenticated user with the view-draft role, including editors and contributors, can exploit it. If guestApiAccess is enabled, any logged-in user can trigger the flaw.

Does a fix exist for this issue?

Yes, patches are available in @apostrophecms/db-connect version 1.1.0 and apostrophe version 4.33.0.