CVE-2026-104848
Tinypool: Prototype Pollution gadget in worker options leads to Remote Code Execution
tinypool passes worker options to new Worker() by reading them off a plain object whose prototype is Object.prototype. Options the application did not set are resolved through the prototype chain and then passed explicitly to worker_threads.Worker.
- No known exploitation
- Severity
- Critical, CVSS 9.5 (v4.0)
- EPSS
- 0.5% chance of exploitation in 30 days (EPSS, as of Oct 23, 2026)
- Affected packages
- tinypool (npm) <= 2.1.0, fixed in 2.1.1 · GHSA-5gmw-xhrv-c9v3