# apostrophe (npm) vulnerabilities 33 known vulnerabilities (2 critical, 9 high, 19 medium, 3 low), with the versions each affects and the releases that fix them. ## At a glance - Latest release: 4.34.0 (Oct 14, 2026): no advisory affects it - Newest unaffected release: 4.34.0 (Oct 14, 2026), the latest release - Weekly downloads: 23.4K - Dependents: 5 - Releases: 500+ since 0.5.386 (Oct 11, 2016) - Registry: https://www.npmjs.com/package/apostrophe - Releases read: Nov 8, 2026 ## Version timeline Affected versions per advisory, in version order: - CVE-2026-113711: 0.5.386 to 4.33.0-beta.1 (4.33.0 is outside it) - CVE-2026-113710: 0.5.386 to 4.33.0-beta.1 (4.33.0 is outside it) - CVE-2026-113669: 0.5.386 to 4.33.0-beta.1 (4.33.0 is outside it) - CVE-2026-113668: 0.5.386 to 4.33.0-beta.1 (4.33.0 is outside it) - CVE-2026-113666: 0.5.386 to 4.33.0-beta.1 (4.33.0 is outside it) - CVE-2026-113665: 0.5.386 to 4.33.0-beta.1 (4.33.0 is outside it) - CVE-2026-113660: 0.5.386 to 4.33.0-beta.1 (4.33.0 is outside it) - CVE-2026-113659: 0.5.386 to 4.33.0-beta.1 (4.33.0 is outside it) - CVE-2026-113658: 0.5.386 to 4.33.0-beta.1 (4.33.0 is outside it) - CVE-2026-113649: 0.5.386 to 4.33.0 (4.34.0 is outside it) - CVE-2026-113655: 0.5.386 to 4.33.0-beta.1 (4.33.0 is outside it) - CVE-2026-113653: 0.5.386 to 4.33.0-beta.1 (4.33.0 is outside it) - CVE-2026-112958: 0.5.386 to 4.33.0 (4.34.0 is outside it) - CVE-2026-112957: 0.5.386 to 4.33.0 (4.34.0 is outside it) - CVE-2026-112954: 0.5.386 to 4.33.0 (4.34.0 is outside it) - CVE-2026-112952: 0.5.386 to 4.33.0 (4.34.0 is outside it) - CVE-2026-112951: 0.5.386 to 4.33.0 (4.34.0 is outside it) - CVE-2026-110904: 0.5.386 to 4.33.0-beta.1 (4.33.0 is outside it) - CVE-2026-71553: 0.5.386 to 4.32.1-beta.2 (4.32.1 is outside it) - CVE-2026-63669: 0.5.386 to 4.31.1-beta.1 (4.32.0 is outside it) - CVE-2026-53609: 0.5.386 to 4.31.0-alpha.1 (4.31.0 is outside it) - CVE-2026-53607: 0.5.386 to 4.31.0-alpha.1 (4.31.0 is outside it) - CVE-2026-45013: 0.5.386 to 4.29.0 (4.30.0-alpha.1 is outside it) - CVE-2026-45012: 0.5.386 to 4.29.0 (4.30.0-alpha.1 is outside it) - CVE-2026-45011: 4.29.0 (4.30.0-alpha.1 is outside it) - CVE-2026-39857: 0.5.386 to 4.28.1 (4.29.0 is outside it) - CVE-2026-35569: 0.5.386 to 4.28.1 (4.29.0 is outside it) - CVE-2026-33889: 0.5.386 to 4.28.1 (4.29.0 is outside it) - CVE-2026-33888: 0.5.386 to 4.28.1 (4.29.0 is outside it) - CVE-2026-33877: 0.5.386 to 4.28.1 (4.29.0 is outside it) - CVE-2026-32730: 0.5.386 to 4.27.1 (4.28.0 is outside it) - CVE-2021-25979: 2.63.0 to 3.3.1 (3.4.0 is outside it) - CVE-2021-25978: 2.63.0 to 3.3.1 (3.4.0 is outside it) Older releases aren't stored, so the earliest spans may start sooner. ## Advisories (33) ### [CVE-2026-113711](https://cve.now/CVE-2026-113711): ApostropheCMS: Unauthenticated resource exhaustion via pre-auth aposBigUpload processing in @apostrophecms/import-export - Severity: High 7.5 - Published: Oct 20, 2026 - Affected: fixed in 4.33.0. - Fixed in 4.33.0 (released Sep 30, 2026, 20 days before disclosure). - The latest release, 4.34.0, is not affected. - 93% of apostrophe downloads last week were affected versions (31.8K). ### [CVE-2026-113710](https://cve.now/CVE-2026-113710): ApostropheCMS: No Attempt Throttling on Authenticated Password-Change Endpoint Enables Unlimited Current-Password Guessing - Severity: Medium 5.9 - Published: Oct 20, 2026 - Affected: fixed in 4.33.0. - Fixed in 4.33.0 (released Sep 30, 2026, 20 days before disclosure). - The latest release, 4.34.0, is not affected. - 93% of apostrophe downloads last week were affected versions (31.8K). ### [CVE-2026-113669](https://cve.now/CVE-2026-113669): ApostropheCMS: Cross-domain session token in URL confers session takeover - Severity: Medium 5.3 - Published: Oct 20, 2026 - Affected: fixed in 4.33.0. - Fixed in 4.33.0 (released Sep 30, 2026, 20 days before disclosure). - The latest release, 4.34.0, is not affected. - 93% of apostrophe downloads last week were affected versions (31.8K). ### [CVE-2026-113668](https://cve.now/CVE-2026-113668): ApostropheCMS: :\_id/locales REST route omits the public-API authorization gate its sibling read routes enforce (unauthenticated doc-existence + locale metadata disclosure) - Severity: Medium 5.3 - Published: Oct 20, 2026 - Affected: fixed in 4.33.0. - Fixed in 4.33.0 (released Sep 30, 2026, 20 days before disclosure). - The latest release, 4.34.0, is not affected. - 93% of apostrophe downloads last week were affected versions (31.8K). ### [CVE-2026-113666](https://cve.now/CVE-2026-113666): ApostropheCMS: Authenticated projection-exclusion prototype-member deletion in @apostrophecms/db-connect causes process-wide denial of service - Severity: High 7.1 - Published: Oct 20, 2026 - Affected: fixed in 4.33.0. - Fixed in 4.33.0 (released Sep 30, 2026, 20 days before disclosure). - The latest release, 4.34.0, is not affected. - 93% of apostrophe downloads last week were affected versions (31.8K). ### [CVE-2026-113665](https://cve.now/CVE-2026-113665): ApostropheCMS: Missing Authorization on Notification PATCH/DELETE Endpoints - Severity: Low 3.7 - Published: Oct 20, 2026 - Affected: fixed in 4.33.0. - Fixed in 4.33.0 (released Sep 30, 2026, 20 days before disclosure). - The latest release, 4.34.0, is not affected. - 93% of apostrophe downloads last week were affected versions (31.8K). ### [CVE-2026-113660](https://cve.now/CVE-2026-113660): ApostropheCMS: Authenticated Object-Level Authorization Bypass in exist-in-locale Reveals Restricted Localized Draft Identifiers - Severity: Medium 4.3 - Published: Oct 20, 2026 - Affected: fixed in 4.33.0. - Fixed in 4.33.0 (released Sep 30, 2026, 20 days before disclosure). - The latest release, 4.34.0, is not affected. - 93% of apostrophe downloads last week were affected versions (31.8K). ### [CVE-2026-113659](https://cve.now/CVE-2026-113659): ApostropheCMS: Client-side Prototype Pollution in apos.http.parseQuery leading to DOM-based XSS against authenticated users - Severity: Medium 6.1 - Published: Oct 20, 2026 - Affected: fixed in 4.33.0. - Fixed in 4.33.0 (released Sep 30, 2026, 20 days before disclosure). - The latest release, 4.34.0, is not affected. - 93% of apostrophe downloads last week were affected versions (31.8K). ### [CVE-2026-113658](https://cve.now/CVE-2026-113658): ApostropheCMS: Unauthenticated CSV import requests leave rejected uploads in the system temporary directory - Severity: High 7.5 - Published: Oct 20, 2026 - Affected: fixed in 4.33.0. - Fixed in 4.33.0 (released Sep 30, 2026, 20 days before disclosure). - The latest release, 4.34.0, is not affected. - 93% of apostrophe downloads last week were affected versions (31.8K). ### [CVE-2026-113649](https://cve.now/CVE-2026-113649): ApostropheCMS: Import API bypasses publication roles for protected content - Severity: Medium 6.5 - Published: Oct 20, 2026 - Affected: fixed in 4.34.0. - Fixed in 4.34.0 (released Oct 14, 2026, 6 days before disclosure). - The latest release, 4.34.0, is not affected. - 94% of apostrophe downloads last week were affected versions (32.1K). ### [CVE-2026-113655](https://cve.now/CVE-2026-113655): ApostropheCMS: Same-parent page reorder in @apostrophecms/page move() re-ranks a restricted parent's children without create authorization - Severity: Medium 4.3 - Published: Oct 20, 2026 - Affected: fixed in 4.33.0. - Fixed in 4.33.0 (released Sep 30, 2026, 20 days before disclosure). - The latest release, 4.34.0, is not affected. - 93% of apostrophe downloads last week were affected versions (31.8K). ### [CVE-2026-113653](https://cve.now/CVE-2026-113653): ApostropheCMS: The general public can access @apostrophecms/user objects via a relationship (viewRole is not applied to the general public) - Severity: Medium 6.9 - Published: Oct 20, 2026 - Affected: fixed in 4.33.0. - Fixed in 4.33.0 (released Sep 30, 2026, 20 days before disclosure). - The latest release, 4.34.0, is not affected. - 93% of apostrophe downloads last week were affected versions (31.8K). ### [CVE-2026-112958](https://cve.now/CVE-2026-112958): ApostropheCMS: Stored XSS via Unescaped Widget Style Attribute Serialization - Severity: Medium 5.4 - Published: Oct 20, 2026 - Affected: fixed in 4.34.0. - Fixed in 4.34.0 (released Oct 14, 2026, 6 days before disclosure). - The latest release, 4.34.0, is not affected. - 94% of apostrophe downloads last week were affected versions (32.1K). ### [CVE-2026-112957](https://cve.now/CVE-2026-112957): ApostropheCMS: GET /api/v1/@apostrophecms/page/:id bypasses viewRole restriction and exposes viewPermission-gated fields to lower-privileged users - Severity: Medium 4.3 - Published: Oct 20, 2026 - Affected: fixed in 4.34.0. - Fixed in 4.34.0 (released Oct 14, 2026, 6 days before disclosure). - The latest release, 4.34.0, is not affected. - 94% of apostrophe downloads last week were affected versions (32.1K). ### [CVE-2026-112954](https://cve.now/CVE-2026-112954): ApostropheCMS: Unauthenticated publicApiProjection bypass via search and sort query builders in the public REST API - Severity: Medium 5.3 - Published: Oct 20, 2026 - Affected: fixed in 4.34.0. - Fixed in 4.34.0 (released Oct 14, 2026, 6 days before disclosure). - The latest release, 4.34.0, is not affected. - 94% of apostrophe downloads last week were affected versions (32.1K). ### [CVE-2026-112952](https://cve.now/CVE-2026-112952): ApostropheCMS: POST /api/v1/@apostrophecms/doc/slugTaken discloses existence of private/admin-only content to any authenticated user - Severity: Medium 4.3 - Published: Oct 20, 2026 - Affected: fixed in 4.34.0. - Fixed in 4.34.0 (released Oct 14, 2026, 6 days before disclosure). - The latest release, 4.34.0, is not affected. - 94% of apostrophe downloads last week were affected versions (32.1K). ### [CVE-2026-112951](https://cve.now/CVE-2026-112951): ApostropheCMS: Color field validation bypass allows stored XSS via HTML appended after rgb()/hsl() prefix - Severity: Medium 5.4 - Published: Oct 20, 2026 - Affected: fixed in 4.34.0. - Fixed in 4.34.0 (released Oct 14, 2026, 6 days before disclosure). - The latest release, 4.34.0, is not affected. - 94% of apostrophe downloads last week were affected versions (32.1K). ### [CVE-2026-110904](https://cve.now/CVE-2026-110904): ApostropheCMS before 4.33.0 allows authentication bypass for REST API page reading, as demonstrated by a /api/v1/@apostrophecms/page?all=1 c - Severity: Medium 5.3 - Published: Oct 15, 2026 - Affected: fixed in 4.33.0. - Fixed in 4.33.0 (released Sep 30, 2026, 15 days before disclosure). - The latest release, 4.34.0, is not affected. - 93% of apostrophe downloads last week were affected versions (31.8K). ### [CVE-2026-71553](https://cve.now/CVE-2026-71553): ApostropheCMS: 2nd-order prototype pollution via PATCH leading to single-request persistent DoS - Severity: High 7.1 - Published: Aug 17, 2026 - Affected: fixed in 4.32.1. - Fixed in 4.32.1 (released Aug 13, 2026, 4 days before disclosure). - The latest release, 4.34.0, is not affected. - 92% of apostrophe downloads last week were affected versions (31.5K). ### [CVE-2026-63669](https://cve.now/CVE-2026-63669): ApostropheCMS: Missing destination-parent authorization in page \`move()\` allows a low-privileged editor to move and re-rank pages inside a… - Severity: Medium 6.5 - Published: Aug 17, 2026 - Affected: fixed in 4.32.0. - Fixed in 4.32.0 (released Jul 10, 2026, 38 days before disclosure). - The latest release, 4.34.0, is not affected. - 92% of apostrophe downloads last week were affected versions (31.3K). ### [CVE-2026-53609](https://cve.now/CVE-2026-53609): Apostrophe has Server-Side Prototype Pollution in apos.util.set via patch operators that leads to process-wide authorization bypass - Severity: Critical 9.1 - Published: Jun 12, 2026 - Affected: fixed in 4.31.0. - Fixed in 4.31.0 (released Jun 10, 2026, 2 days before disclosure). - The latest release, 4.34.0, is not affected. - 92% of apostrophe downloads last week were affected versions (31.2K). ### [CVE-2026-53607](https://cve.now/CVE-2026-53607): @apostrophecms/file pretty-URL Vulnerable to Unauthenticated SSRF via Host header - Severity: Low 3.7 - Published: Jun 12, 2026 - Affected: fixed in 4.31.0. - Fixed in 4.31.0 (released Jun 10, 2026, 2 days before disclosure). - The latest release, 4.34.0, is not affected. - 92% of apostrophe downloads last week were affected versions (31.2K). ### [CVE-2026-45013](https://cve.now/CVE-2026-45013): Apostrophe has a Weak Password Recovery Mechanism for Forgotten Password and Improper Input Validation - Severity: High 8.1 - Published: Jun 12, 2026 - Affected: through 4.29.0. - Fixed in 4.30.0 (released May 13, 2026, 30 days before disclosure), the first release outside every affected range (no listed fixed version clears them all). - The latest release, 4.34.0, is not affected. - 91% of apostrophe downloads last week were affected versions (31.1K). ### [CVE-2026-45012](https://cve.now/CVE-2026-45012): Apostrophe has authenticated SSRF in rich-text widget import via @apostrophecms/area/validate-widget - Severity: High 7.6 - Published: Jun 12, 2026 - Affected: through 4.29.0. - Fixed in 4.30.0 (released May 13, 2026, 30 days before disclosure), the first release outside every affected range (no listed fixed version clears them all). - The latest release, 4.34.0, is not affected. - 91% of apostrophe downloads last week were affected versions (31.1K). ### [CVE-2026-45011](https://cve.now/CVE-2026-45011): Apostrophe has stored XSS via javascript: URL in Image Widget Link - Severity: High 7.3 - Published: Jun 12, 2026 - Affected: versions 4.29.0. - Fixed in 4.30.0 (released May 13, 2026, 30 days before disclosure), the first release outside every affected range (no listed fixed version clears them all). - The latest release, 4.34.0, is not affected. - 0.1% of apostrophe downloads last week were affected versions (50). ### [CVE-2026-39857](https://cve.now/CVE-2026-39857): Information Disclosure via \`choices\`/\`counts\` Query Parameters Bypassing publicApiProjection Field Restrictions - Severity: Medium 5.3 - Published: Apr 15, 2026 - Affected: fixed in 4.29.0. - Fixed in 4.29.0 (released Apr 15, 2026, the day of disclosure). - The latest release, 4.34.0, is not affected. - 91% of apostrophe downloads last week were affected versions (31K). ### [CVE-2026-35569](https://cve.now/CVE-2026-35569): ApostropheCMS: Stored XSS in SEO Fields Leads to Authenticated API Data Exposure in ApostropheCMS - Severity: High 8.7 - Published: Apr 15, 2026 - Affected: fixed in 4.29.0. - Fixed in 4.29.0 (released Apr 15, 2026, the day of disclosure). - The latest release, 4.34.0, is not affected. - 91% of apostrophe downloads last week were affected versions (31K). ### [CVE-2026-33889](https://cve.now/CVE-2026-33889): ApostropheCMS: Stored XSS via CSS Custom Property Injection in \`@apostrophecms/color-field\` Escaping Style Tag Context - Severity: Medium 5.4 - Published: Apr 15, 2026 - Affected: fixed in 4.29.0. - Fixed in 4.29.0 (released Apr 15, 2026, the day of disclosure). - The latest release, 4.34.0, is not affected. - 91% of apostrophe downloads last week were affected versions (31K). ### [CVE-2026-33888](https://cve.now/CVE-2026-33888): ApostropheCMS: publicApiProjection Bypass via \`project\` Query Builder in Piece-Type REST API - Severity: Medium 5.3 - Published: Apr 15, 2026 - Affected: fixed in 4.29.0. - Fixed in 4.29.0 (released Apr 15, 2026, the day of disclosure). - The latest release, 4.34.0, is not affected. - 91% of apostrophe downloads last week were affected versions (31K). ### [CVE-2026-33877](https://cve.now/CVE-2026-33877): ApostropheCMS: User Enumeration via Timing Side Channel in Password Reset Endpoint - Severity: Low 3.7 - Published: Apr 15, 2026 - Affected: fixed in 4.29.0. - Fixed in 4.29.0 (released Apr 15, 2026, the day of disclosure). - The latest release, 4.34.0, is not affected. - 91% of apostrophe downloads last week were affected versions (31K). ### [CVE-2026-32730](https://cve.now/CVE-2026-32730): ApostropheCMS MFA/TOTP Bypass via Incorrect MongoDB Query in Bearer Token Middleware - Severity: High 8.1 - Published: Mar 18, 2026 - Affected: fixed in 4.28.0. - Fixed in 4.28.0 (released Mar 18, 2026, the day of disclosure). - The latest release, 4.34.0, is not affected. - 91% of apostrophe downloads last week were affected versions (31K). ### [CVE-2021-25979](https://cve.now/CVE-2021-25979): Apostrophe - Insufficient Session Expiration - Severity: Critical 9.8 - Published: Nov 8, 2021 - Affected: from 2.63.0, fixed in 3.4.0. - Fixed in 3.4.0 (released Sep 13, 2021, 56 days before disclosure). - The latest release, 4.34.0, is not affected. - 13% of apostrophe downloads last week were affected versions (4.3K). ### [CVE-2021-25978](https://cve.now/CVE-2021-25978): Apostrophe - XSS - Severity: Medium 5.4 - Published: Nov 7, 2021 - Affected: from 2.63.0, fixed in 3.4.0. - Fixed in 3.4.0 (released Sep 13, 2021, 55 days before disclosure). - The latest release, 4.34.0, is not affected. - 13% of apostrophe downloads last week were affected versions (4.3K). --- Source: cve.now Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards. Page: https://cve.now/packages/npm/apostrophe Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.