Prototype Pollution in mongo-object Library

Executive Summary

CVE-2026-16266 is a Prototype Pollution vulnerability in the npm package mongo-object affecting versions before 3.0.3. The expandKey() function in util.js allows attackers to manipulate the JavaScript prototype chain by injecting crafted property paths containing special keys like __proto__. This can overwrite or pollute the Object.prototype, leading to malicious outcomes such as denial of service or remote code execution.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, check if your system uses the affected mongo-object package versions prior to 3.0.3. Run 'npm list mongo-object' to verify the installed version. If the version is below 3.0.3, the system is vulnerable. Additionally, inspect application code for unsafe usage of the expandKey function in util.js.

Commands to check: 'npm list mongo-object', 'grep -r "expandKey" /path/to/project'. Look for __proto__ or similar keys in user input handling.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can lead to denial of service, remote code execution, or property injection attacks. Attackers can modify application behavior by polluting the Object.prototype, causing unexpected behavior across all objects in the application. This may result in data corruption, unauthorized access, or application crashes.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability does not directly affect compliance with GDPR or HIPAA. However, it could indirectly impact compliance by enabling attacks that lead to unauthorized data access, modification, or denial of service, which may violate data protection requirements under these regulations.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately upgrade the mongo-object package to version 3.0.3 or higher using 'npm update mongo-object'. If upgrading is not possible, implement input validation to block keys like __proto__, constructor, and prototype. Freeze the Object.prototype to prevent prototype pollution.

Avoid using unsafe recursive merge functions and consider replacing plain objects with Maps where applicable. Validate all JSON input schemas to ensure no malicious keys are processed.

Useful 0 Not Useful 0