piscina vulnerabilities

2 known vulnerabilities in piscina from Piscinajs. 2 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 9.2 Critical severity

  piscina: Improperly Controlled Modification of Object Prototype Attributes

  CVE-2026-102992Sep 30, 2026Piscinajs

  piscina is a node.js worker pool implementation. Prior to 4.9.4, 5.3.2, and 6.0.0-rc.5, Piscina stores ThreadPool.options in src/index.ts as a plain object that inherits from Object.prototype. Applications with a separate prototype-pollution primitive can ther

• 8.1 High severity

  piscina: Improper Control of Generation of Code

  CVE-2026-55388Jun 22, 2026Piscinajs

  piscina is a node.js worker pool implementation. Prior to 6.0.0-rc.2, 5.2.0, and 4.9.3, piscina's constructor and run() paths read the filename option via plain member access. Both reads fall through the prototype chain when the caller's options object doesn't