@stablelib/cbor: Prototype poisoning via `__proto__` map keys in CBOR decoding
- Severity:
- High
Description
@stablelib/cbor decodes CBOR maps into ordinary JavaScript objects and assigns attacker-controlled keys directly onto those objects. A CBOR map key named __proto__ therefore changes the prototype of the decoded object instead of becoming an ordinary data property.
Recommendation
Update the @stablelib/cbor package to the latest compatible version. Followings are version details:
- Affected version(s): < 2.0.3
- Patched version(s): 2.0.3
References
Related Issues
- @stablelib/cbor: Stack exhaustion Denial of Service via deeply nested CBOR arrays, maps, or tags - Vulnerability
- scimPatch vulnerable to prototype pollution via unfiltered keys in patch - CVE-2026-48170
- @saltcorn/server Remote Code Execution (RCE) / SQL injection via prototype pollution by manipulating `lang` and `defst - Vulnerability
- Serialize JavaScript is Vulnerable to RCE via RegExp.flags and Date.prototype.toISOString() - Vulnerability
You might also like:
- Tags:
- npm
- @stablelib/cbor
Anything's wrong? Let us know Last updated on April 07, 2026