CVE-2026-106448

Awaiting Analysis Awaiting Analysis - Queue

BaseFortify

Publication date: 2026-10-06

Last updated on: 2026-10-07

Assigner: GitHub, Inc.

Description

StableLib is a stable library of useful TypeScript and JavaScript code. Prior to 2.0.4, the @stablelib/cbor CBOR map decoding path creates ordinary JavaScript objects and assigns attacker-controlled keys with bracket assignment. A map key named __proto__ invokes the inherited prototype setter instead of creating an ordinary own property, allowing the decoded object's prototype to contain attacker-controlled authorization or feature-flag values. Downstream code that trusts normal property lookup or merges the decoded object can therefore make security-sensitive decisions using inherited attacker data. This issue is fixed in version 2.0.4.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-06

Last Modified

2026-10-07

Generated

2026-10-19

AI Q&A

2026-10-07

EPSS Evaluated

2026-10-18

NVD

CVE-2026-106448

EUVD

EUVD-2026-93973

Affected Vendors & Products

Vendor	Product	Version / Range
StableLib	stablelib	< 2.0.4

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-1321	The product receives input from an upstream component that specifies attributes that are to be initialized or updated in an object, but it does not properly control modifications of attributes of the object prototype.

Attack-Flow Graph

Executive Summary

The vulnerability in StableLib's @stablelib/cbor library before version 2.0.4 involves improper handling of CBOR map keys. When decoding a CBOR map, attacker-controlled keys are assigned using bracket notation. If a key named __proto__ is used, it triggers the inherited prototype setter instead of creating a normal property. This allows an attacker to inject malicious values into the object's prototype, which can then be inherited by downstream code.

Detection Guidance

This vulnerability involves prototype pollution via CBOR map decoding in StableLib versions before 2.0.4. To detect it, inspect JavaScript/TypeScript applications using @stablelib/cbor for CBOR parsing. Check if any code merges or trusts decoded objects without validation. No direct network commands exist, but you can audit dependencies with npm ls @stablelib/cbor or yarn why @stablelib/cbor to verify versions.

Impact Analysis

This vulnerability can lead to security-sensitive decisions being made based on attacker-controlled data. For example, if downstream code trusts property lookups or merges the decoded object, it might inherit malicious authorization flags or feature settings from the prototype. This could grant unauthorized access or enable other attacks depending on how the library is used.

Compliance Impact

This vulnerability could potentially affect compliance with GDPR and HIPAA by allowing unauthorized modification of object prototypes through crafted CBOR data. This may lead to improper authorization checks or exposure of sensitive data, violating principles of data integrity and access control required by these regulations.

Mitigation Strategies

Update StableLib to version 2.0.4 or later to address the prototype pollution vulnerability in the @stablelib/cbor package.

Hi! I’m here to help you understand CVE-2026-106448. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70