CLSA-2026-1792490541 TuxCare security update for tinypool (2 CVEs)

TuxCare rebuilt tinypool to address 2 CVEs. Fixed in 2.1.0-tuxcare.1...

CLSA-2026-1792490437 TuxCare security update for tinypool (2 CVEs)

TuxCare rebuilt tinypool to address 2 CVEs. Fixed in 1.1.1-tuxcare.1...

ROOT-APP-NPM-AIKIDO-2026-938696 AIKIDO-2026-938696 in tinypool - Patched by Root

Root has patched AIKIDO-2026-938696 in the tinypool package for Root:npm. Multiple fixed versions available...

ROOT-APP-NPM-CVE-2026-104848 CVE-2026-104848 in tinypool - Patched by Root

Root has patched CVE-2026-104848 in the tinypool package for Root:npm. Multiple fixed versions available...

ROOT-APP-NPM-AIKIDO-2026-396404 AIKIDO-2026-396404 in tinypool - Patched by Root

Root has patched AIKIDO-2026-396404 in the tinypool package for Root:npm. Multiple fixed versions available...

ROOT-APP-NPM-CVE-2026-104849 CVE-2026-104849 in tinypool - Patched by Root

Root has patched CVE-2026-104849 in the tinypool package for Root:npm. Multiple fixed versions available...

CVE-2026-104848

A flaw was found in tinypool. When an attacker is able to modify base JavaScript object properties prototype pollution, tinypool inadvertently copies these inherited configuration values into newly spawned worker threads. An attacker can exploit this behavior by injecting malicious startup...

CVE-2026-104849

A flaw was found in tinypool. When processing tasks with caller-supplied configuration options, the worker pool does not verify whether properties, such as the worker filename, belong directly to the provided object. An attacker who can manipulate shared JavaScript base objects prototype pollutio...

EUVD-2026-91718

Tinypool: Prototype Pollution gadget in worker options leads to Remote Code Execution...

GHSA-5GMW-XHRV-C9V3 Tinypool: Prototype Pollution gadget in worker options leads to Remote Code Execution

tinypool passes worker options to new Worker by reading them off a plain object whose prototype is Object.prototype. Options the application did not set are resolved through the prototype chain and then passed explicitly to workerthreads.Worker. Node core ignores Worker options inherited from...

@0zd0/nx-oxfmt (>=0.0.1, <=0.1.1), @1-/fix (>=0.1.4, <=0.1.10) +465 more potentially affected by CVE-2026-104848 via tinypool (>=2.0.0, <=2.1.0)

tinypool NPM version =2.0.0, =0.0.1, =0.1.4, =15.0.0, =1.57.7, =1.3.0, =0.0.0-next.d8e717b, =2.23.0, =0.0.1, =1.0.0, =0.6.0-alpha.26, =0.6.0-alpha.26, =1.1.0, =0.4.0, =1.0.5, =1.0.36 and more Source cves: CVE-2026-104848 Source advisory: OSV:GHSA-5GMW-XHRV-C9V3...

Tinypool: Prototype Pollution gadget in worker options leads to Remote Code Execution

tinypool passes worker options to new Worker by reading them off a plain object whose prototype is Object.prototype. Options the application did not set are resolved through the prototype chain and then passed explicitly to workerthreads.Worker. Node core ignores Worker options inherited from...

@0zd0/nx-oxfmt (>=0.0.1, <=0.1.1), @1-/fix (>=0.1.4, <=0.1.10) +465 more potentially affected by CVE-2026-104848 via tinypool (>=2.0.0, <=2.1.0)

tinypool NPM version =2.0.0, =0.0.1, =0.1.4, =15.0.0, =1.57.7, =1.3.0, =0.0.0-next.d8e717b, =2.23.0, =0.0.1, =1.0.0, =0.6.0-alpha.26, =0.6.0-alpha.26, =1.1.0, =0.4.0, =1.0.5, =1.0.36 and more Source cves: CVE-2026-104848 Source advisory: GHSA-5GMW-XHRV-C9V3...

NPM: Tinypool: Prototype Pollution gadget in worker options leads to Remote Code Execution

NPM: Tinypool: Prototype Pollution gadget in worker options leads to Remote Code Execution vulnerability discovered by ? in WordPress Npm tinypool versions = 2.1.0...

GHSA-85C8-PPGW-CCPR Tinypool: Prototype Pollution Gadget to RCE in run() options

tinypool is a fork of piscina and inherited the same prototype-pollution surface. When pool.runtask, options is called, the filename option is read from the provided options object. If that object does not have an own filename property, the lookup falls through to Object.prototype. An attacker wh...

@0zd0/nx-oxfmt (>=0.0.1, <=0.1.1), @1-/fix (>=0.1.4, <=0.1.10) +465 more potentially affected by CVE-2026-104849 via tinypool (>=2.0.0, <=2.1.0)

tinypool NPM version =2.0.0, =0.0.1, =0.1.4, =15.0.0, =1.57.7, =1.3.0, =0.0.0-next.d8e717b, =2.23.0, =0.0.1, =1.0.0, =0.6.0-alpha.26, =0.6.0-alpha.26, =1.1.0, =0.4.0, =1.0.5, =1.0.36 and more Source cves: CVE-2026-104849 Source advisory: GHSA-85C8-PPGW-CCPR...

@0zd0/nx-oxfmt (>=0.0.1, <=0.1.1), @1-/fix (>=0.1.4, <=0.1.10) +465 more potentially affected by CVE-2026-104849 via tinypool (>=2.0.0, <=2.1.0)

tinypool NPM version =2.0.0, =0.0.1, =0.1.4, =15.0.0, =1.57.7, =1.3.0, =0.0.0-next.d8e717b, =2.23.0, =0.0.1, =1.0.0, =0.6.0-alpha.26, =0.6.0-alpha.26, =1.1.0, =0.4.0, =1.0.5, =1.0.36 and more Source cves: CVE-2026-104849 Source advisory: OSV:GHSA-85C8-PPGW-CCPR...

NPM: Tinypool: Prototype Pollution Gadget to RCE in run() options

NPM: Tinypool: Prototype Pollution Gadget to RCE in run options vulnerability discovered by ? in WordPress Npm tinypool versions 2.1.2...

EUVD-2026-91719

Tinypool: Prototype Pollution Gadget to RCE in run options...

Tinypool: Prototype Pollution Gadget to RCE in run() options

tinypool is a fork of piscina and inherited the same prototype-pollution surface. When pool.runtask, options is called, the filename option is read from the provided options object. If that object does not have an own filename property, the lookup falls through to Object.prototype. An attacker wh...