ROOT-APP-NPM-AIKIDO-2026-396404 AIKIDO-2026-396404 in tinypool - Patched by Root

Root has patched AIKIDO-2026-396404 in the tinypool package for Root:npm. Multiple fixed versions available...

ROOT-APP-NPM-CVE-2026-104849 CVE-2026-104849 in tinypool - Patched by Root

Root has patched CVE-2026-104849 in the tinypool package for Root:npm. Multiple fixed versions available...

ROOT-APP-NPM-AIKIDO-2026-938696 AIKIDO-2026-938696 in tinypool - Patched by Root

Root has patched AIKIDO-2026-938696 in the tinypool package for Root:npm. Multiple fixed versions available...

ROOT-APP-NPM-CVE-2026-104848 CVE-2026-104848 in tinypool - Patched by Root

Root has patched CVE-2026-104848 in the tinypool package for Root:npm. Multiple fixed versions available...

CVE-2026-104848

A flaw was found in tinypool. When an attacker is able to modify base JavaScript object properties prototype pollution, tinypool inadvertently copies these inherited configuration values into newly spawned worker threads. An attacker can exploit this behavior by injecting malicious startup...

CVE-2026-104849

A flaw was found in tinypool. When processing tasks with caller-supplied configuration options, the worker pool does not verify whether properties, such as the worker filename, belong directly to the provided object. An attacker who can manipulate shared JavaScript base objects prototype pollutio...

NPM: Tinypool: Prototype Pollution gadget in worker options leads to Remote Code Execution

NPM: Tinypool: Prototype Pollution gadget in worker options leads to Remote Code Execution vulnerability discovered by ? in WordPress Npm tinypool versions = 2.1.0...

@0zd0/nx-oxfmt (>=0.0.1, <=0.1.1), @1-/fix (>=0.1.4, <=0.1.10) +455 more potentially affected by CVE-2026-104848 via tinypool (>=2.0.0, <=2.1.0)

tinypool NPM version =2.0.0, =0.0.1, =0.1.4, =15.0.0, =1.57.7, =1.3.0, =0.0.0-next.d8e717b, =2.23.0, =0.0.1, =1.0.0, =0.6.0-alpha.26, =0.6.0-alpha.26, =1.1.0, =0.4.0, =1.0.5, =1.0.36 and more Source cves: CVE-2026-104848 Source advisory: GHSA-5GMW-XHRV-C9V3...

@0zd0/nx-oxfmt (>=0.0.1, <=0.1.1), @1-/fix (>=0.1.4, <=0.1.10) +455 more potentially affected by CVE-2026-104848 via tinypool (>=2.0.0, <=2.1.0)

tinypool NPM version =2.0.0, =0.0.1, =0.1.4, =15.0.0, =1.57.7, =1.3.0, =0.0.0-next.d8e717b, =2.23.0, =0.0.1, =1.0.0, =0.6.0-alpha.26, =0.6.0-alpha.26, =1.1.0, =0.4.0, =1.0.5, =1.0.36 and more Source cves: CVE-2026-104848 Source advisory: OSV:GHSA-5GMW-XHRV-C9V3...

GHSA-5GMW-XHRV-C9V3 Tinypool: Prototype Pollution gadget in worker options leads to Remote Code Execution

tinypool passes worker options to new Worker by reading them off a plain object whose prototype is Object.prototype. Options the application did not set are resolved through the prototype chain and then passed explicitly to workerthreads.Worker. Node core ignores Worker options inherited from...

EUVD-2026-91718

Tinypool: Prototype Pollution gadget in worker options leads to Remote Code Execution...

Tinypool: Prototype Pollution gadget in worker options leads to Remote Code Execution

tinypool passes worker options to new Worker by reading them off a plain object whose prototype is Object.prototype. Options the application did not set are resolved through the prototype chain and then passed explicitly to workerthreads.Worker. Node core ignores Worker options inherited from...

@0zd0/nx-oxfmt (>=0.0.1, <=0.1.1), @1-/fix (>=0.1.4, <=0.1.10) +455 more potentially affected by CVE-2026-104849 via tinypool (>=2.0.0, <=2.1.0)

tinypool NPM version =2.0.0, =0.0.1, =0.1.4, =15.0.0, =1.57.7, =1.3.0, =0.0.0-next.d8e717b, =2.23.0, =0.0.1, =1.0.0, =0.6.0-alpha.26, =0.6.0-alpha.26, =1.1.0, =0.4.0, =1.0.5, =1.0.36 and more Source cves: CVE-2026-104849 Source advisory: GHSA-85C8-PPGW-CCPR...

GHSA-85C8-PPGW-CCPR Tinypool: Prototype Pollution Gadget to RCE in run() options

tinypool is a fork of piscina and inherited the same prototype-pollution surface. When pool.runtask, options is called, the filename option is read from the provided options object. If that object does not have an own filename property, the lookup falls through to Object.prototype. An attacker wh...

Tinypool: Prototype Pollution Gadget to RCE in run() options

tinypool is a fork of piscina and inherited the same prototype-pollution surface. When pool.runtask, options is called, the filename option is read from the provided options object. If that object does not have an own filename property, the lookup falls through to Object.prototype. An attacker wh...

NPM: Tinypool: Prototype Pollution Gadget to RCE in run() options

NPM: Tinypool: Prototype Pollution Gadget to RCE in run options vulnerability discovered by ? in WordPress Npm tinypool versions 2.1.2...

@0zd0/nx-oxfmt (>=0.0.1, <=0.1.1), @1-/fix (>=0.1.4, <=0.1.10) +455 more potentially affected by CVE-2026-104849 via tinypool (>=2.0.0, <=2.1.0)

tinypool NPM version =2.0.0, =0.0.1, =0.1.4, =15.0.0, =1.57.7, =1.3.0, =0.0.0-next.d8e717b, =2.23.0, =0.0.1, =1.0.0, =0.6.0-alpha.26, =0.6.0-alpha.26, =1.1.0, =0.4.0, =1.0.5, =1.0.36 and more Source cves: CVE-2026-104849 Source advisory: OSV:GHSA-85C8-PPGW-CCPR...

EUVD-2026-91719

Tinypool: Prototype Pollution Gadget to RCE in run options...

CVE-2026-104849

Tinypool is a minimal Node.js worker thread pool implementation. Prior to 2.1.2, Tinypool reads filename from a caller-supplied options object in pool.runtask, options without requiring an own property, so a polluted Object.prototype.filename can replace the intended worker module. Applications a...

CVE-2026-104848

Tinypool is a minimal Node.js worker thread pool implementation. Prior to 2.1.1, Tinypool constructs ThreadPool.options from a normal options object and reads the execArgv and env worker options in dist/index.js, allowing values inherited from a polluted Object.prototype to be copied into own...