CVE-2026-16266 identifies a prototype pollution vulnerability in the mongo-object package before version 3.0.3. The issue arises in the expandKey() function of util.js, where an attacker can supply a crafted property path with special keys such as __proto__, enabling modification of the JavaScript prototype chain. This can lead to unexpected behavior or security issues in applications using affected versions of mongo-object. The CVSS 4.0 vector indicates network attack vector, low attack complexity, no privileges required, no user interaction, partial impact on integrity and system integrity, and low impact on availability. No vendor advisory or patch information is available to confirm remediation status.

Successful exploitation allows an attacker to perform prototype pollution, potentially altering the behavior of JavaScript objects in applications using mongo-object versions before 3.0.3. This can lead to integrity violations and system integrity issues, which may be leveraged for further attacks or unexpected application behavior. The CVSS score of 6.3 reflects a medium severity impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Users should upgrade to mongo-object version 3.0.3 or later once confirmed or apply any official fixes provided by the vendor. Until then, avoid using vulnerable versions and monitor vendor communications for updates.