{"action":"Upgrade @stablelib/cbor to 2.0.3 or later.","affected":[{"fixed":"2.0.3","introduced":"0"}],"component":"@stablelib/cbor","cve_ids":["CVE-2026-106448"],"ecosystem":"npm","epss":0.00401,"exploited":false,"fixed_versions":["2.0.3"],"ghsa_id":"GHSA-w48f-fwg7-ww6p","id":"tcs_01M5KGDVGW7DF5H9RG04WPJ1HT","modified_at":"2026-10-07T10:56:10.181649137Z","published_at":"2026-04-04T04:24:27Z","references":["https://osv.dev/vulnerability/GHSA-w48f-fwg7-ww6p","https://github.com/StableLib/stablelib/security/advisories/GHSA-w48f-fwg7-ww6p","https://github.com/StableLib/stablelib/commit/0f153a63b7552a0e8721f640984113e419015026","https://github.com/StableLib/stablelib"],"severity":{"label":"high"},"sources":[{"source":"osv","source_id":"GHSA-w48f-fwg7-ww6p","url":"https://osv.dev/vulnerability/GHSA-w48f-fwg7-ww6p"}],"summary":"@stablelib/cbor: Prototype poisoning via `__proto__` map keys in CBOR decoding"}