CVE-2026-106448
HighCVSS 8.9Exploitation Probability (EPSS)
Low risk32th percentile - higher than 32% of all known CVEs
Summary
The StableLib library before version 2.0.4 contains a vulnerability in the CBOR decoder that allows an attacker to inject a '__proto__' key into a JavaScript object. This overwrites the object's prototype, potentially leading to security decisions based on attacker-controlled data.
Risk Assessment
The risk includes bypassing authorization mechanisms or modifying feature flags in the application. This could lead to unauthorized access or privilege escalation in the system.
Recommendation
Upgrade StableLib to version 2.0.4, which fixes the vulnerability. Additionally, it is recommended to validate keys when processing CBOR data.
Other vulnerabilities in StableLib
Original NVD description (English source)
StableLib is a stable library of useful TypeScript and JavaScript code. Prior to 2.0.4, the @stablelib/cbor CBOR map decoding path creates ordinary JavaScript objects and assigns attacker-controlled keys with bracket assignment. A map key named __proto__ invokes the inherited prototype setter instead of creating an ordinary own property, allowing the decoded object's prototype to contain attacker-controlled authorization or feature-flag values. Downstream code that trusts normal property lookup or merges the decoded object can therefore make security-sensitive decisions using inherited attacker data. This issue is fixed in version 2.0.4.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS