Tinylibs vulnerabilities
We track 2 vulnerabilities in Tinylibs products. 2 are rated high or critical, and none are known to be exploited. The most recent was published on October 2, 2026.
2vulnerabilities
2critical
0high
0exploited
9.5average CVSS score
Latest Tinylibs vulnerabilities
- 9.5 Critical severity
tinypool: Improper Control of Generation of Code
Tinypool is a minimal Node.js worker thread pool implementation. Prior to 2.1.2, Tinypool reads filename from a caller-supplied options object in pool.run(task, options) without requiring an own property, so a polluted Object.prototype.filename can replace the
- 9.5 Critical severity
tinypool: Improperly Controlled Modification of Object Prototype Attributes
Tinypool is a minimal Node.js worker thread pool implementation. Prior to 2.1.1, Tinypool constructs ThreadPool.options from a normal options object and reads the execArgv and env worker options in dist/index.js, allowing values inherited from a polluted Objec