High, CVSS 7.1npmAmendedPublished
ApostropheCMS: Authenticated projection-exclusion prototype-member deletion in @apostrophecms/db-connect causes process-wide denial of service
CVE-2026-113666 · GHSA-j5rq-xfvr-p969
- Affected
- npm @apostrophecms/db-connect < 1.1.0
- Fixed in
- 1.1.0· Vendor fix available
- Issue
- @apostrophecms/db-connect ships an in-memory MongoDB emulation used by its SQLite, PostgreSQL, and multipostgres adapters. Its unsetNestedField helper walks an attacker-controlled dotted field path with no segment validation and calls delete on the resolved property. A low-privileged authenticated user (any role holding view-draft, which every editor and contributor has; reduced to any logged-in user when guestApiAccess is enabled) can send a piece-type REST GET request whose project query builder contains an exclusion key such as constructor.prototype.hasOwnProperty. On a SQLite or PostgreSQL adapter this key reaches unsetNestedField, which resolves Object.prototype and deletes a shared runtime method. Because that method is shared across the whole Node process, the deletion breaks request handling for every tenant and user until the process is restarted, giving a single request a persistent denial of service. Root Cause The projection query builder laundens only projection…
Recommended action: Upgrade to 1.1.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.