CVE-2026-97724
Received Received - Intake

Prototype Pollution in React Native Worklets

Publication date: 2026-09-25

Last updated on: 2026-09-25

Assigner: MITRE

Description
A prototype pollution vulnerability in Software Mansion React Native Worklets before 0.12.2 allows an attacker-controlled object containing a __proto__ property to modify the prototype of an object created during serialization in clonePlainJSObject in packages/react-native-worklets/src/memory/serializable.native.ts. When affected data is subsequently processed by React Native Worklets, the malformed serialized object can cause the React Native application to crash. This can result in a remotely triggered denial of service in applications that pass attacker-controlled data through the affected serialization path. In applications where the attacker-controlled data is persisted, the denial of service may persist across application restarts or repeated attempts to access the affected content.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-25
Last Modified
2026-09-25
Generated
2026-09-25
AI Q&A
2026-09-25
EPSS Evaluated
N/A
NVD
CVE-2026-97724
EUVD
EUVD-2026-86500

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
software_mansion react_native_reanimated 0.12.2
software_mansion react_native_worklets *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-1321 The product receives input from an upstream component that specifies attributes that are to be initialized or updated in an object, but it does not properly control modifications of attributes of the object prototype.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a prototype pollution vulnerability in Software Mansion React Native Worklets before version 0.12.2. It allows an attacker to modify the prototype of an object during serialization by including a __proto__ property in attacker-controlled data. This can cause the React Native application to crash, leading to a remotely triggered denial of service.

Detection Guidance

To detect this vulnerability, check if your system uses React Native Worklets versions before 0.12.2. Inspect package.json files for dependencies on react-native-worklets or react-native-reanimated. Test by sending JSON data containing a __proto__ key to your application and observe if crashes occur during serialization.

Impact Analysis

If exploited, this vulnerability can cause your React Native application to crash, resulting in a denial of service. The crash may persist across application restarts if the attacker-controlled data is saved. This affects applications that process or serialize attacker-controlled data through the affected Worklets library.

Compliance Impact

This vulnerability primarily causes application crashes via denial of service, which may indirectly impact compliance by disrupting data processing or availability. However, the CVE does not directly link to GDPR or HIPAA requirements. Compliance impact would depend on how the crash affects data integrity or availability in regulated environments.

Mitigation Strategies

Immediately update React Native Worklets to version 0.12.2 or later. If updating is not possible, filter out __proto__, prototype, and constructor keys from user-controlled input before processing. Avoid using Object.entries or direct bracket notation for assignment in serialization logic.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-97724. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart