Piscina: Prototype pollution gadget in ThreadPool.options allows code execution
Summary
Piscina, a Node.js worker thread pool library, stores its internal options in a plain object that inherits from Object.prototype. An application with a separate prototype pollution flaw can inject inherited values for security-sensitive options such as execArgv, loadBalancer and env, which can lead to attacker-controlled code running in worker threads. Exploitation requires an existing prototype pollution primitive elsewhere in the application.
Affected
- piscina before 4.9.4
- piscina 5.0.0 before 5.3.2
- piscina 6.0.0-rc.1 before 6.0.0-rc.5
Fixed in
- piscina 4.9.4
- piscina 5.3.2
- piscina 6.0.0-rc.5 (release candidate)
Workaround
No vendor workaround known. Upgrade to a fixed version. Where a transitive dependency pins an affected version, an npm override to a fixed version can be used.
Exploitation
- CISA SSVC: exploitation status PoC, automatable: no, technical impact: total
- A public proof-of-concept is reported by a third-party tracker; not verified
- No evidence of exploitation in the wild found; not listed in CISA KEV according to a third-party aggregator
Our recommendation
- Identify all systems and build pipelines that use piscina, including indirect dependencies, for example via lock files and software composition analysis
- Upgrade to 4.9.4, 5.3.2 or 6.0.0-rc.5 or later
- Review the application for prototype pollution flaws and fix them
- Monitor Node.js services for unexpected worker startup flags or environment changes
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- GitHub Security Advisory GHSA-67c8-pqhq-4rmx github.com
- Piscina release v4.9.4 github.com
- Piscina release v5.3.2 github.com
- Piscina release v6.0.0-rc.5 github.com
- Fix commit 0cb12fc github.com
- GitLab Advisory Database CVE-2026-102992 advisories.gitlab.com
- VulDB CVE-2026-102992 vuldb.com
- Miggo CVE-2026-102992 www.miggo.io
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 05:02.
Original description (NVD)
piscina is a node.js worker pool implementation. Prior to 4.9.4, 5.3.2, and 6.0.0-rc.5, Piscina stores ThreadPool.options in src/index.ts as a plain object that inherits from Object.prototype. Applications with a separate prototype-pollution primitive can therefore supply inherited values for security-sensitive options that do not have own defaults. An inherited execArgv value is passed to the Node.js Worker constructor and can preload attacker-controlled code in worker threads, an inherited loadBalancer function can execute during task scheduling, and inherited env values can alter worker environments. This issue is fixed in versions 4.9.4, 5.3.2, and 6.0.0-rc.5.
NVD references (9)
- https://github.com/piscinajs/piscina/commit/0cb12fca37f526065b072592afe954574dcc656f
- https://github.com/piscinajs/piscina/commit/2f69f67159a0e48b38fd61fa4a91c2fdc19fff72
- https://github.com/piscinajs/piscina/commit/5be7bbb19e3787bb698862cd516121a578d690f7
- https://github.com/piscinajs/piscina/commit/bebbda255c2981cecddd36b171b94be2fd41c9a6
- https://github.com/piscinajs/piscina/releases/tag/v4.9.4
- https://github.com/piscinajs/piscina/releases/tag/v5.3.2
- https://github.com/piscinajs/piscina/releases/tag/v6.0.0-rc.5
- https://github.com/piscinajs/piscina/security/advisories/GHSA-67c8-pqhq-4rmx
- https://github.com/piscinajs/piscina/security/advisories/GHSA-67c8-pqhq-4rmx
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.