CVE-2026-104849 · GHSA-85c8-ppgw-ccpr
Tinypool: Prototype Pollution Gadget to RCE in run() options
- Risk score
- 78/100
- CVSS
- 9.5 v4.0
- Exploit chance (30 days)
- 0.4%
- Published
- 2 Oct 2026
Open in the live forecast Today's forecast
What to know
- What it is
- Tinypool is a minimal Node.js worker thread pool implementation. Prior to 2.1.2, Tinypool reads filename from a caller-supplied options object in pool.run(task, options) without requiring an own property, so a polluted Object.prototype.filename can replace the intended worker module. Applications are affected only whe…
- Affected
- tinypool (npm) < 2.1.2
- Fix
- Upgrade tinypool to 2.1.2 or later.
- Exploitation
- Public proof of concept
Story map
At a glance
tinypool: Red, act today. Tinypool is a minimal Node.js worker thread pool implementation. Prior to 2.1.1, Tinypool constructs ThreadPool.options from a normal options object and reads the execArgv and env worker options in dist/index.js, allowing values inherited from a polluted Object.prototype to be copied into own properties and passed to …
The flaws
- CVE-2026-104849: Tinypool: Prototype Pollution Gadget to RCE in run() options (CVSS 9.5 · EPSS 0%)
- CVE-2026-104848: Tinypool: Prototype Pollution gadget in worker options leads to Remote Code Execution (CVSS 9.5 · EPSS 0%)
The fix
Upgrade tinypool: 2.1.2 · 2.1.1 or later on your release line
Who is exposed: tinypool (npm) <= 2.1.0
Where it stands
- Public proof of concept
Connects to
- Same weakness: Code injection (CWE-94). 239 other warnings in 30 days
Why it is Amber
- CVSS 9.5 critical
- Public exploit or proof of concept referenced
- Remotely exploitable without logging in
- On your watchlist: npm
Affected packages
| Package | Ecosystem | Vulnerable | Fixed in |
|---|---|---|---|
| tinypool | npm | < 2.1.2 | 2.1.2 |
References
- https://github.com/advisories/GHSA-85c8-ppgw-ccpr
- https://github.com/tinylibs/tinypool/security/advisories/GHSA-85c8-ppgw-ccpr
- https://nvd.nist.gov/vuln/detail/CVE-2026-104849
- https://github.com/tinylibs/tinypool/pull/135
- https://github.com/tinylibs/tinypool/commit/f41411a3e23324c674f35a19a3240f7a7c40ffbf
- https://github.com/tinylibs/tinypool/releases/tag/v2.1.2
- https://github.com/advisories/GHSA-85c8-ppgw-ccpr
Original description
Tinypool is a minimal Node.js worker thread pool implementation. Prior to 2.1.2, Tinypool reads filename from a caller-supplied options object in pool.run(task, options) without requiring an own property, so a polluted Object.prototype.filename can replace the intended worker module. Applications are affected only when they pass their own second-argument options object to pool.run(); calls without that argument use the trusted default options object. An attacker who can first pollute the prototype can cause the worker pool to load attacker-selected JavaScript and can read or modify task data with the host process's privileges. This issue is fixed in version 2.1.2.
Last activity 2 Oct 2026. Patch Forecast updates every hour.