CVE-2026-73654
1 advisory.
npm/@trigger.dev/core CVE-2026-73654: high 8.5
Trigger.dev: Prototype pollution via run metadata operations → process-wide cross-tenant DoS
Action: Upgrade @trigger.dev/core to 4.5.6 or later.
npm i @trigger.dev/core@4.5.6Affected
| introduced | fixed | last affected |
|---|---|---|
| 3.3.8 | 4.5.6 | - |
Fixed versions
| 4.5.6 |
Sources
- osv: GHSA-p28v-f755-9qrg
- https://github.com/triggerdotdev/trigger.dev/security/advisories/GHSA-p28v-f755-9qrg
- https://github.com/triggerdotdev/trigger.dev/pull/4316
- https://github.com/triggerdotdev/trigger.dev/commit/6997aeb05e27d2db47f9eda01fdc8a17c81a1ae0
- https://github.com/triggerdotdev/trigger.dev
- https://github.com/triggerdotdev/trigger.dev/releases/tag/v4.5.6
CVE-2026-73654 · published · modified · JSON