CVE-2026-104849 Tinypool: Prototype Pollution Gadget to RCE in run() options

Critical 9.5 Published 2 Oct 2026 Updated 6 Oct 2026

Prototype pollution allows attackers to inject malicious code into Tinypool worker threads, leading to remote code execution and data manipulation.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2026-104849?

CVE-2026-104849 is a critical code injection vulnerability in tinylibs tinypool, published on 2 Oct 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Tinypool is a minimal Node.js worker thread pool implementation. Prior to 2.1.2, Tinypool reads filename from a caller-supplied options object in pool.run(task, options) without requiring an own property, so a polluted Object.prototype.filename can replace the intended worker module. Applications are affected only when they pass their own second-argument options object to pool.run(); calls without that argument use the trusted default options object. An attacker who can first pollute the prototype can cause the worker pool to load attacker-selected JavaScript and can read or modify task data with the host process's privileges. This issue is fixed in version 2.1.2.

Weakness: CWE-94, CWE-1321

Which versions are affected by CVE-2026-104849?

2 open source packages ship an affected version, including tinypool.

Package	Affected	Fixed in
`tinypool` npm	All versions	`2.1.2`
`tinypool` npm	All versions	`2.1.2`

How do I fix CVE-2026-104849?

Upgrade tinypool to 2.1.2 or later.

Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.

Is CVE-2026-104849 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-104849 exists.

Public exploit code: 1 proofs of concept on GitHub.

Sources

Also known as GHSA-85c8-ppgw-ccpr, MINI-gxwj-p3jh-hhmf, MINI-h7jp-5cxp-xjrh, MINI-m3v6-h2vv-mx54, MINI-p77r-ccmp-9pj3, ROOT-APP-NPM-CVE-2026-104849.