GHSA-vmg4-6gfg-83qx: Npm/apostrophe vulnerability

Published Sep 2, 2026
·
Updated

The vulnerability is a single-request persistent DoS by submitting e.g. "PATCH /api/v1/article/<id>" with a valid editor session and body of {"toString.call":"x"}, overwriting the global toString function with value x.

Fabian

Affected Software

1 affected component
npm/apostrophe<=4.32.0

Event History

Sep 2, 2026
Advisory Published
via GitHub·03:12 PM
Data Sourced
via GitHub·03:12 PM
DescriptionWeaknessAffected Software

Frequently Asked Questions

1

What level of access does an attacker need to trigger the denial of service?

The attacker needs a valid editor session. The described request targets an article API endpoint and can be sent as a single request.

2

What request pattern causes the issue?

The issue is triggered by submitting a PATCH request to /api/v1/article/<id> with a body such as {"toString.call":"x"}. This overwrites the global toString function with the value x, causing a persistent denial of service.

3

Is the denial of service persistent after the malicious request completes?

Yes. The vulnerability is described as a single-request persistent denial of service because the request overwrites a global function.

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203