CVE-2026-104849
CriticalCVSS 9.5Summary
Tinypool prior to 2.1.2 reads filename from a caller-supplied options object in pool.run(task, options) without requiring an own property, so a polluted Object.prototype.filename can replace the intended worker module. Applications are affected only when they pass their own second-argument options object to pool.run(); calls without that argument use the trusted default options object. An attacker who can first pollute the prototype can cause the worker pool to load attacker-selected JavaScript and can read or modify task data with the host process's privileges. This issue is fixed in version 2.1.2.
Risk Assessment
The risk includes arbitrary JavaScript code execution with host process privileges and potential access to sensitive data or modification of task data, which could lead to application security compromise.
Recommendation
It is recommended to upgrade Tinypool to version 2.1.2 or later, avoid passing custom options objects to pool.run() unless necessary, and protect against prototype pollution.
Other vulnerabilities in Tinypool
Original NVD description (English source)
Tinypool is a minimal Node.js worker thread pool implementation. Prior to 2.1.2, Tinypool reads filename from a caller-supplied options object in pool.run(task, options) without requiring an own property, so a polluted Object.prototype.filename can replace the intended worker module. Applications are affected only when they pass their own second-argument options object to pool.run(); calls without that argument use the trusted default options object. An attacker who can first pollute the prototype can cause the worker pool to load attacker-selected JavaScript and can read or modify task data with the host process's privileges. This issue is fixed in version 2.1.2.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS