CVE-2026-34221: Mikro-Orm Mikroorm

Critical severity, CVSS 9.1. EPSS: 0.5% chance of exploitation in the next 30 days.

MikroORM is a TypeScript ORM for Node.js based on Data Mapper, Unit of Work and Identity Map patterns. Prior to versions 6.6.10 and 7.0.6, a prototype pollution vulnerability exists in the Utils.merge helper used internally by MikroORM when merging object structures. The function did not prevent special keys such as __proto__, constructor, or prototype, allowing attacker-controlled input to modify the JavaScript object prototype when merged. This issue has been patched in versions 6.6.10 and 7.0.6.

Affected products

• Mikro-Orm Mikroorm: before 6.6.10 (fixed in 6.6.10); from 7.0.0, before 7.0.6 (fixed in 7.0.6)

Published 2026-03-31. Last modified 2026-07-24.