CVE-2026-102992

npm/piscina CVE-2026-102992: critical, EPSS 0.43%

piscina: Prototype-pollution gadget in ThreadPool.options allows RCE via execArgv / loadBalancer / env

Action: Upgrade piscina to 4.9.4 or later.

npm i piscina@5.3.2

npm i piscina@4.9.4

npm i piscina@6.0.0-rc.5

Affected

Fixed versions

Sources

• osv: GHSA-67c8-pqhq-4rmx
• https://github.com/piscinajs/piscina/security/advisories/GHSA-67c8-pqhq-4rmx
• https://nvd.nist.gov/vuln/detail/CVE-2026-102992
• https://github.com/piscinajs/piscina/commit/0cb12fca37f526065b072592afe954574dcc656f
• https://github.com/piscinajs/piscina/commit/2f69f67159a0e48b38fd61fa4a91c2fdc19fff72
• https://github.com/piscinajs/piscina/commit/5be7bbb19e3787bb698862cd516121a578d690f7
• https://github.com/piscinajs/piscina/commit/bebbda255c2981cecddd36b171b94be2fd41c9a6
• https://github.com/piscinajs/piscina
• https://github.com/piscinajs/piscina/releases/tag/v4.9.4
• https://github.com/piscinajs/piscina/releases/tag/v5.3.2
• https://github.com/piscinajs/piscina/releases/tag/v6.0.0-rc.5

CVE-2026-102992 · published 2026-10-01T15:03:33Z · modified 2026-10-01T15:15:09.198862052Z · JSON