[pkg-vuln] CVE-2026-104848 in tinypool@1.1.1 #1371

New Issue

kert · 2026-10-27T16:14:58Z

kert commented

2026-10-27 16:14:58 +00:00

Severity: CRITICAL
Package: tinypool @ 1.1.1
Fixed in: 2.1.1

Tinypool is a minimal Node.js worker thread pool implementation. Prior to 2.1.1, Tinypool constructs ThreadPool.options from a normal options object and reads the execArgv and env worker options in dist/index.js, allowing values inherited from a polluted Object.prototype to be copied into own properties and passed to worker_threads.Worker. An attacker who can first pollute either property can cause each newly spawned worker to load attacker-selected JavaScript through command-line preload argume

Reference: https://nvd.nist.gov/vuln/detail/CVE-2026-104848

**Severity:** CRITICAL **Package:** `tinypool` @ `1.1.1` **Fixed in:** `2.1.1` Tinypool is a minimal Node.js worker thread pool implementation. Prior to 2.1.1, Tinypool constructs ThreadPool.options from a normal options object and reads the execArgv and env worker options in dist/index.js, allowing values inherited from a polluted Object.prototype to be copied into own properties and passed to worker_threads.Worker. An attacker who can first pollute either property can cause each newly spawned worker to load attacker-selected JavaScript through command-line preload argume **Reference:** https://nvd.nist.gov/vuln/detail/CVE-2026-104848

kert added this to the P21: Package Supply Chain — inventory, mirrors, drift, vuln scanning milestone 2026-10-27 16:14:58 +00:00

kert added the quality ci labels 2026-10-27 16:14:58 +00:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: homelab/stack#1371