CVE-2026-102992 Details
Description
piscina is a node.js worker pool implementation. Prior to 4.9.4, 5.3.2, and 6.0.0-rc.5, Piscina stores ThreadPool.options in src/index.ts as a plain object that inherits from Object.prototype. Applications with a separate prototype-pollution primitive can therefore supply inherited values for security-sensitive options that do not have own defaults. An inherited execArgv value is passed to the Node.js Worker constructor and can preload attacker-controlled code in worker threads, an inherited loadBalancer function can execute during task scheduling, and inherited env values can alter worker environments. This issue is fixed in versions 4.9.4, 5.3.2, and 6.0.0-rc.5.
A prototype pollution vulnerability has been identified in Piscina, a Node.js worker pool implementation, affecting versions 4.x, 5.x (confirmed on 5.3.1), and 6.0.0-rc.x. The vulnerability arises because ThreadPool.options is stored as a plain object inheriting from Object.prototype. This allows applications to inject inherited values into security-sensitive options that lack default values, potentially leading to remote code execution or other malicious impacts. Exploitation is possible by manipulating the prototype to include harmful payloads, which are then executed in worker threads or alter the worker environment.
Users can upgrade to Piscina versions 4.9.4, 5.3.2, or 6.0.0-rc.5, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Sep 30, 2026CISA-ADP
Assessed Sep 30, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-1321 | Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| piscinajs piscina | ~5 ~4 ~6.0.0-rc (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 30, 2026 | CVE Modified | CISA-ADP |
| Sep 30, 2026 | New CVE Received | [email protected] |