[pkg-vuln] CVE-2026-104849 in tinypool@1.1.1 #1372

New Issue

kert · 2026-10-27T16:14:59Z

kert commented

2026-10-27 16:14:59 +00:00

Severity: CRITICAL
Package: tinypool @ 1.1.1
Fixed in: 2.1.2

Tinypool is a minimal Node.js worker thread pool implementation. Prior to 2.1.2, Tinypool reads filename from a caller-supplied options object in pool.run(task, options) without requiring an own property, so a polluted Object.prototype.filename can replace the intended worker module. Applications are affected only when they pass their own second-argument options object to pool.run(); calls without that argument use the trusted default options object. An attacker who can first pollute the prototy

Reference: https://nvd.nist.gov/vuln/detail/CVE-2026-104849

**Severity:** CRITICAL **Package:** `tinypool` @ `1.1.1` **Fixed in:** `2.1.2` Tinypool is a minimal Node.js worker thread pool implementation. Prior to 2.1.2, Tinypool reads filename from a caller-supplied options object in pool.run(task, options) without requiring an own property, so a polluted Object.prototype.filename can replace the intended worker module. Applications are affected only when they pass their own second-argument options object to pool.run(); calls without that argument use the trusted default options object. An attacker who can first pollute the prototy **Reference:** https://nvd.nist.gov/vuln/detail/CVE-2026-104849

kert added this to the P21: Package Supply Chain — inventory, mirrors, drift, vuln scanning milestone 2026-10-27 16:14:59 +00:00

kert added the quality ci labels 2026-10-27 16:14:59 +00:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: homelab/stack#1372