Read the docs
TI-2026-66135 Aliases CVE-2026-104849GHSA-85c8-ppgw-ccpr

Tinypool: Prototype Pollution Gadget to RCE in run() options

Priority HIGH 82CWE-1321Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
Present
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Partial Red Hat: 2 without a fix

Attack profile from CVSS 4.0 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-94.

Summary

Tinypool is a minimal Node.js worker thread pool implementation. Prior to 2.1.2, Tinypool reads filename from a caller-supplied options object in pool.run(task, options) without requiring an own property, so a polluted Object.prototype.filename can replace the intended worker module. Applications are affected only when they pass their own second-argument options object to pool.run(); calls without that argument use the trusted default options object. An attacker who can first pollute the prototype can cause the worker pool to load attacker-selected JavaScript and can read or modify task data with the host process's privileges. This issue is fixed in version 2.1.2.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00485 42nd percentileScored 2026-11-07
Fix Partial tinypool (tinylibs): 2.1.2tinypool (npm): 2.1.2Red Hat: 2 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
Yes
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
tinylibstinypoolbefore 2.1.22.1.2Patch availableCNA
—tinypool (npm)before 2.1.22.1.2Patch availableGHSA-85c8-ppgw-ccpr
  • tinypool Vendortinylibs Affected before 2.1.2 Fixed in 2.1.2 Patch available CNA
  • tinypool (npm) Vendor— Affected before 2.1.2 Fixed in 2.1.2 Patch available GHSA-85c8-ppgw-ccpr

Remediation

  • Fix · CNA tinypool (tinylibs) Fixed in 2.1.2
  • Fix · GHSA-85c8-ppgw-ccpr tinypool (npm) Fixed in 2.1.2 Advisory →

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat AMQ Broker 7AffectedNo fix yet
Red Hat Build of Podman DesktopAffectedNo fix yet
Not affected: 5 products
  • Red Hat AMQ Broker 7
  • Red Hat Ansible Automation Platform 2
  • Red Hat Hardened Images
  • Red Hat JBoss Enterprise Application Platform 8
  • Red Hat JBoss Enterprise Application Platform Expansion Pack

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-104849
  2. 2026-10-06 Alias added: GHSA-85c8-ppgw-ccpr
  3. 2026-10-06 Fix available: npm/[email protected] · GHSA-85c8-ppgw-ccpr
  4. 2026-10-06 CVSS score added · GHSA-85c8-ppgw-ccpr
  5. 2026-10-06 Weakness changed · GHSA-85c8-ppgw-ccpr
  6. 2026-10-06 6 new references · GHSA-85c8-ppgw-ccpr
  7. 2026-10-06 CISA SSVC decision points changed
  8. 2026-10-06 Priority changed: MEDIUM → HIGH
  9. 2026-10-07 Affected versions changed · Red Hat
  10. 2026-10-07 CVSS score added · Red Hat
  11. 2026-10-09 Affected versions changed · Red Hat
  12. 2026-10-10 Affected versions changed · Red Hat
  13. 2026-10-26 Affected versions changed · Red Hat
  14. 2026-11-06 Affected versions changed · Red Hat

References

Advisory 1

Other 5

  • TI-2026-66134 Tinypool: Prototype Pollution gadget in worker options leads to Remote Code Execution CVSS 4.0CRITICAL 9.5

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences