CVE-2026-113666

ApostropheCMS is an open-source Node.js content management system. Prior to 1.1.0 of db-connect and 4.33.0 of ApostropheCMS, an account with view-draft access can submit a projection exclusion path that traverses through a constructor prototype chain to a shared prototype member when a consumer uses a SQLite, PostgreSQL, or multipostgres adapter and has a matching document. Every editing role has view-draft access, while guestApiAccess broadens this prerequisite to any logged-in account. The unsetNestedField helper then deletes the shared runtime member, causing persistent process-wide integrity and availability effects; the default MongoDB adapter is not affected. This issue is fixed in db-connect 1.1.0 and ApostropheCMS 4.33.0.

ApostropheCMS is an open-source Node.js content management system. Prior to 1.1.0 of db-connect and 4.33.0 of ApostropheCMS, an account with view-draft access can submit a projection exclusion path that traverses through a constructor prototype chain to a shared prototype member when a consumer uses a SQLite, PostgreSQL, or multipostgres adapter and has a matching document. Every editing role has view-draft access, while guestApiAccess broadens this prerequisite to any logged-in account. The unsetNestedField helper then deletes the shared runtime member, causing persistent process-wide integrity and availability effects; the default MongoDB adapter is not affected. This issue is fixed in db-connect 1.1.0 and ApostropheCMS 4.33.0.

Summary

@apostrophecms/db-connect ships an in-memory MongoDB emulation used by its SQLite, PostgreSQL, and multipostgres adapters. Its unsetNestedField helper walks an attacker-controlled dotted field path with no segment validation and calls delete on the resolved property. A low-privileged authenticated user (any role holding view-draft, which every editor and contributor has; reduced to any logged-in user when guestApiAccess is enabled) can send a piece-type REST GET request whose project query builder contains an exclusion key such as constructor.prototype.hasOwnProperty. On a SQLite or PostgreSQL adapter this key reaches unsetNestedField, which resolves Object.prototype and deletes a shared runtime method. Because that method is shared across the whole Node process, the deletion breaks request handling for every tenant and user until the process is restarted, giving a single request a persistent denial of service.

Root Cause

The projection query builder laundens only projection values, never projection keys, so an arbitrary dotted key survives to the database layer. On the SQLite and PostgreSQL adapters an exclusion projection is applied in JavaScript by applyProjection, which for each excluded field calls unsetNestedField(result, field). unsetNestedField splits the field on . and walks the resulting segments with no guard: unlike its sibling setNestedField, it does not even block a literal __proto__, and neither helper blocks constructor or prototype. Because the working object is a plain object produced by JSON.parse(JSON.stringify(doc)), its constructor resolves to the global Object, so a path of constructor.prototype.<member> reaches the shared Object.prototype and deletes a core, configurable method. The violated invariant is that untrusted input must never be able to traverse into and mutate shared prototype objects.

Affected functions (repository-relative paths):
- unsetNestedField  packages/db-connect/lib/shared.js:119-129  (no segment guard; delete on resolved property)
- applyProjection   packages/db-connect/lib/shared.js:164-216  (exclusion branch calls unsetNestedField per excluded key)
Reachability driver (consumer on a SQL adapter):
- project.launder / project.finalize  packages/apostrophe/modules/@apostrophecms/doc-type/index.js:2003-2103
- getRestQuery                        packages/apostrophe/modules/@apostrophecms/piece-type/index.js:1139-1157
- SQLite adapter applyProjection call packages/db-connect/adapters/sqlite.js:906,980

Impact

Prerequisites: an authenticated account holding view-draft (every editing role; any logged-in user when guestApiAccess: true), and a consumer configured to use a SQLite, PostgreSQL, or multipostgres adapter. The default mongodb adapter hands the projection to the real MongoDB driver and is not affected. With those conditions, a single crafted GET request deletes an attacker-chosen shared prototype method (for example Object.prototype.hasOwnProperty, toString, or an Array.prototype member). The demonstrated capability is a persistent, process-wide denial of service: after the deletion, ordinary calls such as obj.hasOwnProperty(...) throw across Apostrophe, its dependencies, and the database driver, so the affected Node process cannot service requests for any user until it is restarted. The attacker chooses which member to remove, and the corruption of shared runtime state persists for the life of the process.

Proof of Concept

The finding was reproduced by executing the shipped helper directly against the published db-connect source; a live consumer requires a SQLite or PostgreSQL adapter, an authenticated view-draft session, and at least one matching document.

1. Authenticate as any user with view-draft on a site whose database adapter is sqlite, postgres, or multipostgres.
2. Issue a piece-type REST read with an exclusion projection whose key targets a shared prototype…

ApostropheCMS is an open-source Node.js content management system. Prior to 1.1.0 of db-connect and 4.33.0 of ApostropheCMS, an account with view-draft access can submit a projection exclusion path that traverses through a constructor prototype chain to a shared prototype member when a consumer uses a SQLite, PostgreSQL, or multipostgres adapter and has a matching document. Every editing role has view-draft access, while guestApiAccess broadens this prerequisite to any logged-in account. The unsetNestedField helper then deletes the shared runtime member, causing persistent process-wide integrity and availability effects; the default MongoDB adapter is not affected. This issue is fixed in db-connect 1.1.0 and ApostropheCMS 4.33.0.

ApostropheCMS is an open-source Node.js content management system. Prior to 1.1.0 of db-connect and 4.33.0 of ApostropheCMS, an account with view-draft access can submit a projection exclusion path that traverses through a constructor prototype chain to a shared prototype member when a consumer uses a SQLite, PostgreSQL, or multipostgres adapter and has a matching document. Every editing role has view-draft access, while guestApiAccess broadens this prerequisite to any logged-in account. The unsetNestedField helper then deletes the shared runtime member, causing persistent process-wide integrity and availability effects; the default MongoDB adapter is not affected. This issue is fixed in db-connect 1.1.0 and ApostropheCMS 4.33.0.

Summary

@apostrophecms/db-connect ships an in-memory MongoDB emulation used by its SQLite, PostgreSQL, and multipostgres adapters. Its unsetNestedField helper walks an attacker-controlled dotted field path with no segment validation and calls delete on the resolved property. A low-privileged authenticated user (any role holding view-draft, which every editor and contributor has; reduced to any logged-in user when guestApiAccess is enabled) can send a piece-type REST GET request whose project query builder contains an exclusion key such as constructor.prototype.hasOwnProperty. On a SQLite or PostgreSQL adapter this key reaches unsetNestedField, which resolves Object.prototype and deletes a shared runtime method. Because that method is shared across the whole Node process, the deletion breaks request handling for every tenant and user until the process is restarted, giving a single request a persistent denial of service.

Root Cause

The projection query builder laundens only projection values, never projection keys, so an arbitrary dotted key survives to the database layer. On the SQLite and PostgreSQL adapters an exclusion projection is applied in JavaScript by applyProjection, which for each excluded field calls unsetNestedField(result, field). unsetNestedField splits the field on . and walks the resulting segments with no guard: unlike its sibling setNestedField, it does not even block a literal __proto__, and neither helper blocks constructor or prototype. Because the working object is a plain object produced by JSON.parse(JSON.stringify(doc)), its constructor resolves to the global Object, so a path of constructor.prototype.<member> reaches the shared Object.prototype and deletes a core, configurable method. The violated invariant is that untrusted input must never be able to traverse into and mutate shared prototype objects.

Affected functions (repository-relative paths):
- unsetNestedField  packages/db-connect/lib/shared.js:119-129  (no segment guard; delete on resolved property)
- applyProjection   packages/db-connect/lib/shared.js:164-216  (exclusion branch calls unsetNestedField per excluded key)
Reachability driver (consumer on a SQL adapter):
- project.launder / project.finalize  packages/apostrophe/modules/@apostrophecms/doc-type/index.js:2003-2103
- getRestQuery                        packages/apostrophe/modules/@apostrophecms/piece-type/index.js:1139-1157
- SQLite adapter applyProjection call packages/db-connect/adapters/sqlite.js:906,980

Impact

Prerequisites: an authenticated account holding view-draft (every editing role; any logged-in user when guestApiAccess: true), and a consumer configured to use a SQLite, PostgreSQL, or multipostgres adapter. The default mongodb adapter hands the projection to the real MongoDB driver and is not affected. With those conditions, a single crafted GET request deletes an attacker-chosen shared prototype method (for example Object.prototype.hasOwnProperty, toString, or an Array.prototype member). The demonstrated capability is a persistent, process-wide denial of service: after the deletion, ordinary calls such as obj.hasOwnProperty(...) throw across Apostrophe, its dependencies, and the database driver, so the affected Node process cannot service requests for any user until it is restarted. The attacker chooses which member to remove, and the corruption of shared runtime state persists for the life of the process.

Proof of Concept

The finding was reproduced by executing the shipped helper directly against the published db-connect source; a live consumer requires a SQLite or PostgreSQL adapter, an authenticated view-draft session, and at least one matching document.

1. Authenticate as any user with view-draft on a site whose database adapter is sqlite, postgres, or multipostgres.
2. Issue a piece-type REST read with an exclusion projection whose key targets a shared prototype…