CVE-2026-44966 is a prototype pollution vulnerability in shepherdwind's velocity.js (version 2.1.5 and earlier). The issue arises during the processing of #set directives in Velocity templates, enabling an attacker who can supply templates to modify Object.prototype. This can result in denial of service or remote code execution depending on the server environment. The vulnerability is network exploitable without privileges or user interaction, with a CVSS 3.1 score of 8.3 indicating high severity. No patch or official remediation level has been disclosed as of the publication date.

An attacker able to control Velocity templates processed by velocity.js can exploit this vulnerability to alter Object.prototype, potentially causing denial of service or remote code execution on the affected server. This could compromise the confidentiality, integrity, and availability of the affected system. The impact depends on the server environment and how the application uses velocity.js.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, avoid rendering untrusted or attacker-controlled Velocity templates. Implement strict input validation and template sanitization to reduce risk. Monitor vendor channels for updates and apply patches promptly once available.