IT SBIT Services
Schneeberger
DEEN
CVE tracker

Tinypool: Prototype pollution leading to code execution in run() options

CVE-2026-104849Critical 9.5Public exploit

← All vulnerabilities

Summary

Tinypool is a Node.js worker thread pool library. Versions before 2.1.2 read the worker filename from a caller-supplied options object without checking for own properties, so a polluted Object.prototype.filename can replace the intended worker module. An attacker who can first pollute the prototype can make the pool load attacker-selected JavaScript and read or modify task data with the privileges of the host process. Applications are only affected when they pass their own second-argument options object to pool.run().

Affected

  • tinypool (npm) versions before 2.1.2
  • Affected only when pool.run() is called with a custom second-argument options object
  • Typically a transitive dependency in build, test and developer tooling

Fixed in

  • Version 2.1.2 (fix commit f41411a, PR #135)
  • Version 2.1.2 also covers CVE-2026-104848 (GHSA-5gmw-xhrv-c9v3)

Workaround

  • Calls to pool.run(task) without a second argument are not affected; this reduces exposure but is not a fix
  • Review and patch dependencies that can pollute prototypes (for example lodash.merge or qs.parse)

Exploitation

  • Known exploited: Unknown. No evidence in the reviewed sources.
  • Public proof of concept: Yes, referenced in the GitHub advisory (not reproduced).
  • CISA SSVC: exploitation status poc, automatable yes, technical impact total.
  • An attacker must first pollute Object.prototype through a separate flaw.

Our recommendation

  • Check lockfiles (package-lock.json, yarn.lock, bun.lock) and CI/build environments for tinypool below 2.1.2, including transitive copies.
  • Upgrade to tinypool 2.1.2 or later.
  • Identify and fix prototype pollution sources in your Node.js applications and dependencies.
  • Prioritise internet-facing Node.js services that process untrusted input.
  • Monitor for unexpected worker module loads and anomalies in build pipelines.

Public exploits

Links to third-party sites, not checked by us – exploit code can contain malware. Only use it in isolated test environments.

Research sources

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 23:35.

Original description (NVD)

Tinypool is a minimal Node.js worker thread pool implementation. Prior to 2.1.2, Tinypool reads filename from a caller-supplied options object in pool.run(task, options) without requiring an own property, so a polluted Object.prototype.filename can replace the intended worker module. Applications are affected only when they pass their own second-argument options object to pool.run(); calls without that argument use the trusted default options object. An attacker who can first pollute the prototype can cause the worker pool to load attacker-selected JavaScript and can read or modify task data with the host process's privileges. This issue is fixed in version 2.1.2.

NVD references (5)

Sources

The tracker combines official, freely usable data sources – updated continuously:

This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.

Affected? We can help.

We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.

Get in touchRSS feed