CVE-2026-104849: Tinylibs Tinypool

Critical severity, CVSS 9.5. EPSS: 0.4% chance of exploitation in the next 30 days.

Tinypool is a minimal Node.js worker thread pool implementation. Prior to 2.1.2, Tinypool reads filename from a caller-supplied options object in pool.run(task, options) without requiring an own property, so a polluted Object.prototype.filename can replace the intended worker module. Applications are affected only when they pass their own second-argument options object to pool.run(); calls without that argument use the trusted default options object. An attacker who can first pollute the prototype can cause the worker pool to load attacker-selected JavaScript and can read or modify task data with the host process's privileges. This issue is fixed in version 2.1.2.

Affected products

• Tinylibs Tinypool: before 2.1.2 (fixed in 2.1.2)

Published 2026-10-02. Last modified 2026-10-06.