CVE-2026-104849
1 advisory.
npm/tinypool CVE-2026-104849: critical, EPSS 0.39%
Tinypool: Prototype Pollution Gadget to RCE in run() options
Action: Upgrade tinypool to 2.1.2 or later.
npm i tinypool@2.1.2Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 2.1.2 | - |
Fixed versions
| 2.1.2 |
Sources
- osv: GHSA-85c8-ppgw-ccpr
- https://github.com/tinylibs/tinypool/security/advisories/GHSA-85c8-ppgw-ccpr
- https://nvd.nist.gov/vuln/detail/CVE-2026-104849
- https://github.com/tinylibs/tinypool/pull/135
- https://github.com/tinylibs/tinypool/commit/f41411a3e23324c674f35a19a3240f7a7c40ffbf
- https://github.com/tinylibs/tinypool
- https://github.com/tinylibs/tinypool/releases/tag/v2.1.2
CVE-2026-104849 · published · modified · JSON