CVE-2026-106448 StableLib: Prototype poisoning via `__proto__` map keys in CBOR decoding
Attackers can poison object prototypes via CBOR decoding to inject malicious properties, potentially bypassing security checks in downstream applications.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-106448?
CVE-2026-106448 is a high-severity unsafe deserialization vulnerability in stablelib, published on 6 Oct 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
StableLib is a stable library of useful TypeScript and JavaScript code. Prior to 2.0.4, the @stablelib/cbor CBOR map decoding path creates ordinary JavaScript objects and assigns attacker-controlled keys with bracket assignment. A map key named __proto__ invokes the inherited prototype setter instead of creating an ordinary own property, allowing the decoded object's prototype to contain attacker-controlled authorization or feature-flag values. Downstream code that trusts normal property lookup or merges the decoded object can therefore make security-sensitive decisions using inherited attacker data. This issue is fixed in version 2.0.4.
Weakness: CWE-1321
Which versions are affected by CVE-2026-106448?
2 open source packages ship an affected version, including @stablelib/cbor.
| Package | Affected | Fixed in |
|---|---|---|
@stablelib/cbor npm | All versions | 2.0.3 |
@stablelib/cbor npm | All versions | 2.0.3 |
How do I fix CVE-2026-106448?
Upgrade @stablelib/cbor to 2.0.3 or later.
Upgrade, and only deserialise data from trusted sources or with an allow-list of types. More about Unsafe deserialization.
Is CVE-2026-106448 being exploited?
There is no known exploitation of CVE-2026-106448 in the wild and no public exploit code.
Sources
Also known as GHSA-w48f-fwg7-ww6p.