CVE-2026-14893

The CVE is applicable to IBM Observability with Instana (Agent). The vulnerable component is the Node.js tracer, package @instana/core version 6.2.1, within IBM Instana Agent builds 1.0.303 through 1.0.320. The root cause is a prototype pollution flaw in the configuration normalization API, enabl...

@copart/ops-tool-kit (>=0.4.1, <=0.4.11), @instana/autoprofile (>=2.24.0, <=6.2.1) +16 more potentially affected by CVE-2026-14893 via @instana/core (>=1.64.0, <=6.2.1)

@instana/core NPM version =1.64.0, =0.4.1, =2.24.0, =1.99.0, =1.74.0, =3.0.0, =1.64.0, =1.106.1, =1.106.1, =1.134.0, =1.92.4, =3.9.0, =1.99.0, =1.1.0, =1.79.0, =1.65.0, =1.140.1 and more Source cves: CVE-2026-14893 Source advisory: MEND:CVE-2026-14893...

CVE-2026-14893: Improperly Controlled Modification of Object Prototype Attributes

IBM Observability with Instana Agent Build 1.0.303 through 1.0.320 IBM Instana Node.js tracer component @instana/core version 6.2.1 is vulnerable to prototype pollution through its configuration normalization API...