Prototype poisoning in StableLib CBOR decoding via __proto__ map keys
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- Present
- Impact type
- —
- Confidentiality · integrity · availability
- None · High · None
- Fix status
- Fixed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA.
Summary
StableLib's @stablelib/cbor package, before 2.0.4, creates ordinary JavaScript objects when decoding CBOR maps and assigns attacker-controlled keys with bracket assignment. A map key named __proto__ triggers the inherited prototype setter, so the decoded object's prototype can hold attacker-chosen values (CWE-1321). An unauthenticated remote attacker can supply such CBOR data, and downstream code that trusts normal property lookup or merges the decoded object may make security-sensitive decisions based on those inherited values.
Written with Claude Haiku 5.5 from the sources below · 2026-10-29
Description from the CNA
StableLib is a stable library of useful TypeScript and JavaScript code. Prior to 2.0.4, the @stablelib/cbor CBOR map decoding path creates ordinary JavaScript objects and assigns attacker-controlled keys with bracket assignment. A map key named __proto__ invokes the inherited prototype setter instead of creating an ordinary own property, allowing the decoded object's prototype to contain attacker-controlled authorization or feature-flag values. Downstream code that trusts normal property lookup or merges the decoded object can therefore make security-sensitive decisions using inherited attacker data. This issue is fixed in version 2.0.4.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
Remediation
Update stablelib to version 2.0.4, which fixes this issue. The sources list no fixed version.
Written with Claude Haiku 5.5 from the sources below · 2026-10-29
- Fix · CNA stablelib (StableLib) Fixed in 2.0.4
Timeline
- 2026-10-06 Threatist record created from CVE-2026-106448
- 2026-10-07 CISA SSVC decision points changed
- 2026-10-07 Priority changed: MEDIUM → LOW
References
More StableLib vulnerabilities
- TI-2026-68927 Stack exhaustion in StableLib CBOR decoder causes denial of service CVSS 4.0HIGH 8.7
Sources
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences