CVE-2026-111172

Deferred Deferred - Pending Action

Prototype Pollution in @casl/ability Library

Publication date: 2026-10-15

Last updated on: 2026-10-16

Assigner: VulnCheck

Description

@casl/ability 6.7.5 before 7.0.2 contains a prototype pollution vulnerability in rulesToFields() that allows attackers to modify inherited builtins via dotted condition keys. Attackers controlling rule conditions can supply keys like 'toString.call' to alter shared builtin functions process-wide, causing denial of service for the Node.js process.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-15

Last Modified

2026-10-16

Generated

2026-10-19

AI Q&A

2026-10-16

EPSS Evaluated

2026-10-18

NVD

CVE-2026-111172

EUVD

EUVD-2026-102299

Affected Vendors & Products

Vendor	Product	Version / Range
stalniy	@casl/ability	6.7.5

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-1321	The product receives input from an upstream component that specifies attributes that are to be initialized or updated in an object, but it does not properly control modifications of attributes of the object prototype.

Attack-Flow Graph

Executive Summary

This vulnerability is a prototype pollution issue in the @casl/ability library versions 6.7.5 through 7.0.1. The rulesToFields() function allows attackers to modify inherited built-in objects by injecting keys with dotted notation, such as 'toString.call'. This can alter shared built-in functions across the Node.js process, potentially causing denial of service.

Detection Guidance

To detect this vulnerability, check if your system uses @casl/ability versions 6.7.5 through 7.0.1. Run: npm list @casl/ability or yarn list @casl/ability. If the version is within this range, the system is vulnerable.

Impact Analysis

Attackers exploiting this vulnerability could cause denial of service for the Node.js process by modifying built-in functions. This may disrupt application functionality and require process restart. The impact is limited to applications using vulnerable versions of @casl/ability.

Compliance Impact

This vulnerability could indirectly impact compliance with GDPR or HIPAA by enabling denial-of-service attacks on Node.js applications using affected @casl/ability versions. Such attacks may disrupt services handling sensitive data, potentially violating availability requirements under these regulations.

Mitigation Strategies

Upgrade @casl/ability to version 7.0.2 or later immediately. Use: npm update @casl/ability or yarn upgrade @casl/ability. Review custom code for reliance on hasOwnProperty and update to Object.hasOwn.

Hi! I’m here to help you understand CVE-2026-111172. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70