CVE-2026-16266 Details
Description
Versions of the package mongo-object before 3.0.3 are vulnerable to Prototype Pollution via the expandKey() function in util.js. An attacker can modify the JavaScript prototype chain by supplying a crafted property path containing special keys such as __proto__.
A prototype pollution vulnerability has been identified in the mongo-object package, affecting versions prior to 3.0.3. The issue arises in the expandKey() function within util.js, where an attacker can manipulate the JavaScript prototype chain by providing a crafted property path that includes special keys such as __proto__. This vulnerability allows for the injection of properties into existing JavaScript prototypes, which can then be exploited to overwrite critical object attributes, potentially leading to denial-of-service conditions or unauthorized code execution.
Users are advised to upgrade the mongo-object package to version 3.0.3 or higher.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jul 21, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-1321 | Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') | [email protected] |
Affected Products
No affected product data is available for this CVE.
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 21, 2026 | CVE Modified | CISA-ADP |
| Jul 21, 2026 | New CVE Received | [email protected] |