Piscinajs vulnerabilities
We track 2 vulnerabilities in Piscinajs products. 2 are rated high or critical, and none are known to be exploited. The most recent was published on September 30, 2026.
2vulnerabilities
1critical
1high
0exploited
8.6average CVSS score
Latest Piscinajs vulnerabilities
- 9.2 Critical severity
piscina: Improperly Controlled Modification of Object Prototype Attributes
piscina is a node.js worker pool implementation. Prior to 4.9.4, 5.3.2, and 6.0.0-rc.5, Piscina stores ThreadPool.options in src/index.ts as a plain object that inherits from Object.prototype. Applications with a separate prototype-pollution primitive can ther
- 8.1 High severity
piscina: Improper Control of Generation of Code
piscina is a node.js worker pool implementation. Prior to 6.0.0-rc.2, 5.2.0, and 4.9.3, piscina's constructor and run() paths read the filename option via plain member access. Both reads fall through the prototype chain when the caller's options object doesn't