Executive Summary

CVE-2026-55388 is a high-severity vulnerability in the piscina Node.js worker pool library that allows Remote Code Execution (RCE) through prototype pollution.

The issue occurs because piscina reads the 'filename' option via plain member access, which means if the caller's options object does not have its own 'filename' property, the code falls back to reading it from the prototype chain.

If an attacker manages to pollute Object.prototype.filename (for example, through upstream prototype pollution vulnerabilities in dependencies like lodash, qs, or minimist), the piscina worker thread will import and execute the attacker's malicious .mjs file.

This leads to the attacker's code running within the worker thread, enabling arbitrary code execution.

Useful 0 Not Useful 0

Impact Analysis

Exploitation of this vulnerability allows an attacker to execute arbitrary code remotely within the context of the piscina worker thread.

• Data exfiltration: The attacker can steal sensitive data processed by the application.
• Response poisoning: The attacker can manipulate the responses returned by the worker.
• Process manipulation: The attacker can control return values and potentially affect the stability or behavior of the entire process.

The malicious code persists until the process is restarted, making the impact long-lasting during runtime.

Useful 0 Not Useful 0

Detection Guidance

Detection of this vulnerability involves identifying if your system is running a vulnerable version of the piscina library (versions <= 5.1.4, <= 4.9.2, and <= 6.0.0-rc.1) and checking for signs of prototype pollution affecting Object.prototype.filename.

You can start by verifying the installed version of piscina in your Node.js environment using the following command:

• npm list piscina

To detect prototype pollution, you may inspect if Object.prototype.filename has been modified unexpectedly. In a Node.js REPL or script, you can run:

• console.log(Object.prototype.filename)

If this outputs a value other than undefined, it indicates prototype pollution which could be exploited by this vulnerability.

Additionally, monitoring for unexpected execution of .mjs files or unusual worker thread behavior in your application logs may help detect exploitation attempts.

Useful 0 Not Useful 0

Mitigation Strategies

The primary mitigation step is to upgrade the piscina library to a fixed version where the vulnerability is resolved. Specifically, update to version 6.0.0-rc.2, 5.2.0, or 4.9.3 or later.

If immediate upgrade is not possible, ensure that no upstream dependencies or code paths allow prototype pollution, especially targeting Object.prototype.filename.

Review and sanitize any user-controllable inputs or dependencies that could lead to prototype pollution.

Monitor your application for suspicious worker thread activity or unexpected execution of .mjs files.

Consider applying runtime protections or sandboxing to limit the impact of potential remote code execution.

Useful 0 Not Useful 0