Loading story…
The maintainers of the Node.js package object-path released a series of fixes for prototype pollution flaws affecting applications that use the library in inherited-properties mode through includeInheritedProps or withInheritedProps. The vulnerable behavior involved methods such as set(), del(), empty(), push(), and insert(), where attacker-controlled paths could target magic properties like __proto__ and constructor.prototype and potentially modify object prototypes. The package documentation states that the default object-path instance in versions 0.11.0 and later was not affected.
A follow-up hardening change closed a bypass of the earlier mitigation by blocking dangerous paths supplied as non-string or non-numeric values, including nested array path components. Repository tests show the library now rejects attempts to write through prototype-linked paths and raises errors containing "For security reasons" when objectPath.withInheritedProps.set is used with those values. Version 0.11.8 also added protections to get(), causing it to throw when code attempts to access restricted properties such as __proto__ or constructor in inherited-props mode.
See affected versions and whether adversaries are exploiting it.
4 events from the most recent confirmed update back to the earliest known activity.
Version 0.11.8 added protections so get() throws an exception when code attempts to access magic properties such as __proto__ or constructor while using inherited-props mode. This extended the library's prototype pollution defenses beyond write operations.
Version 0.11.6 fixed a bypass of the earlier 0.11.5 mitigation that could be triggered using non-string or non-numeric path values in inherited-props mode. This addressed a way around the initial prototype pollution protections.
Version 0.11.5 introduced a security fix for prototype pollution affecting functions such as set(), del(), empty(), push(), and insert() when object-path was used with inherited properties enabled via includeInheritedProps or withInheritedProps. The default object-path instance in versions 0.11.0 and later was stated to be unaffected.
A GitHub commit added security tests showing that dangerous paths like __proto__ and constructor.prototype must be blocked even when path components are supplied in nested arrays or other non-string forms. The tests verified that objectPath.withInheritedProps.set throws a security error instead of modifying Object.prototype or class prototypes.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Two critical prototype pollution vulnerabilities, **CVE-2026-48713** and **CVE-2026-48714**, were disclosed in the widely used Node.js internationalization components **`i18next-fs-backend`** and **`i18next-http-middleware`**. The bugs allow attacker-controlled missing translation keys to traverse unsafe path segments such as `__proto__`, `constructor`, and `prototype`, potentially writing arbitrary properties into **`Object.prototype`**. In affected deployments, successful exploitation can trigger application crashes, corrupt translation behavior, poison configuration, and bypass property-based security checks. The primary backend flaw affects **`i18next-fs-backend`** versions before **`2.6.6`**, while the middleware flaw affects **`i18next-http-middleware`** versions before **`3.9.7`** and can help remote input reach the vulnerable backend path by failing to block dotted payloads such as `__proto__.polluted`. Exploitation depends on applications exposing **`missingKeyHandler`** or similar **`saveMissing`** functionality to untrusted users with key splitting enabled. Maintainers patched the issues by blocking unsafe path traversal, and defenders are advised to upgrade immediately, restrict missing-key routes to trusted users, disable missing-key persistence for untrusted input, or set **`keySeparator`** to **`false`** where appropriate.
Jun 29, 2026
jQuery released version **3.4.0** to remediate a prototype-pollution vulnerability in its `extend()` function. Applications that recursively merged or deep-cloned attacker-controlled JSON could allow `__proto__` properties to alter JavaScript object prototypes, potentially causing exceptions and denial of service or tampering with application behavior. The flaw could turn inherited properties into security-relevant values—for example, making an otherwise undefined `isAdmin` check evaluate as true—depending on application code. Organizations using affected jQuery versions should upgrade to **3.4.0 or later**, review deep-merge handling of untrusted input, and use safer object patterns such as null-prototype objects or `Map` where appropriate.
Aug 28, 2026
Axios patched several high-severity vulnerabilities affecting its Node.js HTTP adapter, including **CVE-2026-40175**, a critical flaw in versions below `1.13.2` that Singapore's CSA said could enable unauthenticated **SSRF**, potential remote code execution, and full cloud compromise. Separate disclosures also detailed **CVE-2026-42264**, which affects Axios `1.0.0` through `1.15.1` and allows attacker-controlled values inherited from a polluted `Object.prototype` to alter request behavior, enabling credential injection, request redirection, SSRF to Unix sockets, arbitrary code execution during redirects, and weaker HTTP parsing. Axios fixed that issue in `1.15.2` after merging hardening changes into the main branch. A later advisory described **CVE-2026-44494**, another prototype-pollution gadget in Axios's handling of `config.proxy` that affects versions from `1.0.0` up to but not including `1.16.0`, with the `0.x` branch also tracked as affected below `0.32.0`. If an application already contains a separate prototype-pollution source, the flaw can silently route outbound Axios traffic through an attacker-controlled proxy, exposing **Authorization headers, cookies, and request bodies** while allowing forged responses and full man-in-the-middle interception. Axios addressed the issue in `1.16.0`, and a backport commit for the `0.x` line added null-prototype object merging and other hardening measures to reduce prototype-pollution risk.
Jul 10, 2026