tinypool vulnerabilities

2 known vulnerabilities in tinypool from Tinylibs. 2 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 9.5 Critical severity

  tinypool: Improper Control of Generation of Code

  CVE-2026-104849Oct 2, 2026Tinylibs

  Tinypool is a minimal Node.js worker thread pool implementation. Prior to 2.1.2, Tinypool reads filename from a caller-supplied options object in pool.run(task, options) without requiring an own property, so a polluted Object.prototype.filename can replace the

• 9.5 Critical severity

  tinypool: Improperly Controlled Modification of Object Prototype Attributes

  CVE-2026-104848Oct 2, 2026Tinylibs

  Tinypool is a minimal Node.js worker thread pool implementation. Prior to 2.1.1, Tinypool constructs ThreadPool.options from a normal options object and reads the execArgv and env worker options in dist/index.js, allowing values inherited from a polluted Objec