Description
@stablelib/cbor decodes CBOR maps into ordinary JavaScript objects and assigns attacker-controlled keys directly onto those objects. A CBOR map key named __proto__ therefore changes the prototype of the decoded object instead of becoming an ordinary data property.
Recommendation
Update the @stablelib/cbor package to the latest compatible version. Followings are version details:
- Affected version(s): < 2.0.3
- Patched version(s): 2.0.3
References
Could your website be exposed too?
SmartScanner can check your website for @stablelib/cbor: Prototype poisoning via `__proto__` map keys in CBOR decoding and gives you actionable findings to investigate.
Start a free scanRelated Issues
- @stablelib/cbor: Stack exhaustion Denial of Service via deeply nested CBOR arrays, maps, or tags - Vulnerability
- scimPatch vulnerable to prototype pollution via unfiltered keys in patch - CVE-2026-48170
- @saltcorn/server Remote Code Execution (RCE) / SQL injection via prototype pollution by manipulating `lang` and `defst - Vulnerability
- Serialize JavaScript is Vulnerable to RCE via RegExp.flags and Date.prototype.toISOString() - Vulnerability
You might also like:
See something that needs correcting? Let us knowUpdated April 07, 2026