npm/tinypool CVE-2026-104848: critical, EPSS 0.50%
Tinypool: Prototype Pollution gadget in worker options leads to Remote Code Execution
Action: Upgrade tinypool to 2.1.1 or later.
npm i tinypool@2.1.1Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 2.1.1 | - |
Fixed versions
| 2.1.1 |
Sources
- osv: GHSA-5gmw-xhrv-c9v3
- https://github.com/tinylibs/tinypool/security/advisories/GHSA-5gmw-xhrv-c9v3
- https://nvd.nist.gov/vuln/detail/CVE-2026-104848
- https://github.com/tinylibs/tinypool/pull/134
- https://github.com/tinylibs/tinypool/commit/24df4e730e7d0857a6d226c9b58f8924227404fd
- https://github.com/tinylibs/tinypool
- https://github.com/tinylibs/tinypool/releases/tag/v2.1.1
CVE-2026-104848 · published · modified · JSON