CVE-2026-104849 in Tinypool
Summary
by MITRE • 10/02/2026
Tinypool is a minimal Node.js worker thread pool implementation. Prior to 2.1.2, Tinypool reads filename from a caller-supplied options object in pool.run(task, options) without requiring an own property, so a polluted Object.prototype.filename can replace the intended worker module. Applications are affected only when they pass their own second-argument options object to pool.run(); calls without that argument use the trusted default options object. An attacker who can first pollute the prototype can cause the worker pool to load attacker-selected JavaScript and can read or modify task data with the host process's privileges. This issue is fixed in version 2.1.2.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 10/02/2026
The vulnerability identified in Tinypool prior to version 2.1.2 represents a significant prototype pollution risk that stems from improper handling of user-supplied configuration objects within its worker thread management system. Tinypool, designed as a minimal implementation for managing Node.js worker threads, relies on an options object passed during the execution of tasks via the pool.run method. The core technical flaw lies in how this function processes properties from the provided options object without verifying whether those properties are direct members of that specific object or if they have been inherited through the prototype chain. Specifically, when a caller supplies a second argument representing configuration options to pool.run, the implementation directly accesses properties such as filename from this object using standard property access mechanisms rather than employing safer checks like hasOwnProperty or Object.prototype.hasOwnProperty.call. This oversight allows an attacker who has previously polluted the global Object.prototype with malicious values to intercept and override these expected configurations.
The operational impact of this vulnerability is severe because it enables arbitrary code execution within the context of the host process. By injecting a crafted filename property into Object.prototype, an adversary can force Tinypool to load a JavaScript module chosen by the attacker instead of the intended worker script. Since Node.js workers typically operate with elevated privileges relative to untrusted input data, successfully exploiting this flaw grants the attacker full control over the execution environment associated with that pool instance. This capability allows for comprehensive reading and modification of task data, potentially leading to data exfiltration, integrity violations, or further lateral movement within the application infrastructure depending on how the worker processes are utilized in the broader system architecture.
This issue is categorized under CWE-1325, which describes improper check for unusual input values that leads to prototype pollution, and aligns with MITRE ATT&CK techniques related to command and script interpretation as well as defense evasion through process injection or manipulation of execution flow. The vulnerability specifically affects applications that explicitly pass a custom options object as the second argument to pool.run; calls relying on default parameters remain unaffected because they utilize an internal trusted configuration structure not subject to external prototype pollution in this manner. To mitigate this risk, developers must ensure their code does not rely on unvalidated properties from user-controlled objects when configuring critical system components like worker pools.
Remediation requires upgrading Tinypool to version 2.1.2 or later where the internal logic has been corrected to properly isolate property lookups from prototype inheritance chains. For applications unable to immediately upgrade, defensive coding practices should be implemented by explicitly checking for own properties before accessing configuration values or by using Object.create(null) to create option objects that do not inherit from Object.prototype. Additionally, input validation strategies should enforce strict schemas on any options object passed to library functions to prevent unexpected property injection. Maintaining up-to-date dependencies and employing static analysis tools capable of detecting prototype pollution patterns are essential steps in preventing exploitation of this class of vulnerability in Node.js environments.