Threats affecting pkg:npm/piscina

CVE-2026-102992 is a critical prototype pollution vulnerability in the Node.js worker pool implementation piscina. Versions prior to 4.9.4, 5.3.2, and 6.0.0-rc.5 are affected. The issue arises because ThreadPool.options is stored as a plain object inheriting from Object.prototype, allowing attackers to supply inherited values for security-sensitive options. This can lead to attacker-controlled code execution in worker threads via inherited execArgv, loadBalancer, or env values. The vulnerability is fixed in versions 4.9.4, 5.3.2, and 6.0.0-rc.5.

piscina is a node.js worker pool implementation. Prior to 6.0.0-rc.2, 5.2.0, and 4.9.3, piscina's constructor and run() paths read the filename option via plain member access. Both reads fall through the prototype chain when the caller's options object doesn't have filename as an own property. When Object.prototype.filename is polluted upstream the inherited value flows to worker_threads.Worker import and the attacker's .mjs runs in the worker. This vulnerability is fixed in 6.0.0-rc.2, 5.2.0, and 4.9.3.