CVE-2023-26113: Collection.js Project Collection.js

High severity, CVSS 7.5. EPSS: 1.2% chance of exploitation in the next 30 days.

Versions of the package collection.js before 6.8.1 are vulnerable to Prototype Pollution via the extend function in Collection.js/dist/node/iterators/extend.js.

Affected products

• Collection.js Project Collection.js: before 6.8.1 (fixed in 6.8.1)

Published 2023-03-18. Last modified 2026-06-17.