GHSA-vmg4-6gfg-83qx: Npm/apostrophe vulnerability
Published Sep 2, 2026
·Updated
The vulnerability is a single-request persistent DoS by submitting e.g. "PATCH /api/v1/article/<id>" with a valid editor session and body of {"toString.call":"x"}, overwriting the global toString function with value x.
Fabian
Affected Software
1 affected component
npm/apostrophe<=4.32.0
Event History
Sep 2, 2026
Advisory Published
via GitHub·03:12 PM
Data Sourced
via GitHub·03:12 PM
DescriptionWeaknessAffected Software
Frequently Asked Questions
1
What level of access does an attacker need to trigger the denial of service?
The attacker needs a valid editor session. The described request targets an article API endpoint and can be sent as a single request.
2
What request pattern causes the issue?
The issue is triggered by submitting a PATCH request to /api/v1/article/<id> with a body such as {"toString.call":"x"}. This overwrites the global toString function with the value x, causing a persistent denial of service.
3
Is the denial of service persistent after the malicious request completes?
Yes. The vulnerability is described as a single-request persistent denial of service because the request overwrites a global function.