Node.js Worker Pool Implementation Vulnerability in Piscina by PiscinaJS
CVE-2026-55388
8.1HIGH
What is CVE-2026-55388?
The piscine library, a Node.js worker pool implementation, contains a vulnerability that allows an attacker to exploit the filename property through prototype pollution. Versions prior to 6.0.0-rc.2, 5.2.0, and 4.9.3 are susceptible due to the library's handling of the filename option. If a caller's options object doesn't have filename as its own property, the lookup traverses the prototype chain, potentially leading to execution of malicious code in the worker threads. This issue is addressed in the latest releases.
Affected Version(s)
piscina < 4.9.3 < 4.9.3
piscina >= 5.0.0-alpha.0, < 5.2.0 < 5.0.0-alpha.0, 5.2.0
piscina >= 6.0.0-rc.1, < 6.0.0-rc.2 < 6.0.0-rc.1, 6.0.0-rc.2