{"action":"No fix published. Pin and monitor.","affected":[{"introduced":"0","last_affected":"4.32.0"}],"component":"apostrophe","cve_ids":["CVE-2026-71553"],"ecosystem":"npm","epss":0.00429,"exploited":false,"fixed_versions":[],"ghsa_id":"GHSA-vmg4-6gfg-83qx","id":"tcs_01M5KGCB1GTS7MB80FDEKM3346","modified_at":"2026-09-02T15:30:17.631063461Z","published_at":"2026-09-02T15:12:41Z","references":["https://osv.dev/vulnerability/GHSA-vmg4-6gfg-83qx","https://github.com/apostrophecms/apostrophe/security/advisories/GHSA-vmg4-6gfg-83qx","https://nvd.nist.gov/vuln/detail/CVE-2026-71553","https://github.com/apostrophecms/apostrophe/commit/5a3746aaed49761e171c2cbfe793267c959829fd","https://github.com/apostrophecms/apostrophe"],"severity":{"label":"high"},"sources":[{"source":"osv","source_id":"GHSA-vmg4-6gfg-83qx","url":"https://osv.dev/vulnerability/GHSA-vmg4-6gfg-83qx"}],"summary":"ApostropheCMS: 2nd-order prototype pollution via PATCH leading to single-request persistent DoS"}