CVE-2026-113666

Name of the Vulnerable Software and Affected Versions @apostrophecms/db-connect versions 1.0.0 through 1.0.2 ApostropheCMS versions prior to 4.33.0

Description A low-privileged authenticated user with view-draft access can trigger a persistent process-wide denial of service in environments using SQLite, PostgreSQL, or multipostgres adapters. The issue occurs when a consumer uses the piece-type REST GET endpoint GET /api/v1/@apostrophecms/<piece-type> and submits a crafted projection exclusion path in the project query builder. Specifically, by using a path such as constructor.prototype.hasOwnProperty, an attacker can traverse the constructor prototype chain to reach a shared prototype member.

The unsetNestedField() function fails to validate path segments, allowing the delete operator to remove a shared runtime method from Object.prototype. Because this prototype is shared across the entire Node.js process, the deletion breaks request handling for all users and tenants until the process is restarted. The default MongoDB adapter is not affected as it delegates projections to the native MongoDB driver.

Recommendations Update @apostrophecms/db-connect to version 1.1.0. Update ApostropheCMS to version 4.33.0. As a temporary mitigation, use the default MongoDB adapter or restrict authenticated API access to the piece-type REST endpoints to only fully trusted roles.