← Back to the live CVE advisory feed

CVE-2026-104848: tinypool

Severity

9.5 (CRITICAL)

Vendor

TINYLIBS

Affected versions

< 2.1.1

Fixed version

2.1.1.

Patch status

Patched

Published

2026-10-02T17:17:03.473

Modified

2026-10-02T18:33:20.487

Why it matters

This matters because the affected product may allow code execution. Prioritize systems that are internet-facing or have privileged access to other infrastructure.

Recommended admin actions

• Prioritize validation immediately due to critical CVSS severity.
• Compare installed versions against the affected version range in the advisory.

Technical summary

Tinypool is a minimal Node.js worker thread pool implementation. Prior to 2.1.1, Tinypool constructs ThreadPool.options from a normal options object and reads the execArgv and env worker options in dist/index.js, allowing values inherited from a polluted Object.prototype to be copied into own properties and passed to worker_threads.Worker. An attacker who can first pollute either property can cause each newly spawned worker to load attacker-selected JavaScript through command-line preload arguments or NODE_OPTIONS, resulting in code execution with the host process's privileges and possible access to CI secrets, signing material, or build artifacts. This issue is fixed in version 2.1.1.

View the official NVD record for CVE-2026-104848

CVE data is sourced from NVD/CNA records and optional enrichment. Validate against the vendor advisory before taking production action.