External risk intelligence

Tinypool Node.js Worker Pool Code Execution Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.5)

CVE-2026-104848

Tinypool is a Node.js library used for worker thread management within an application's internal code logic. It is not an internet-facing service, appliance, or edge gateway. Vulnerabilities in such libraries are typically reached through application-specific input processing or build-time dependencies rather than direct public network exposure.

Halo Surface Signal: 1 out of 5 — much less likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A vulnerability in a Node.js library called Tinypool could allow an attacker to execute arbitrary code within host processes. This could potentially lead to unauthorized access to sensitive information like secrets, signing materials, or build artifacts. The main concern is confirming if our systems utilize this library and are therefore exposed.

Allows code execution on servers.
Matters if Node.js worker threads are used.
Confirm if the library is in use.

Attack Path

How an attacker could exploit the issue

An attacker could exploit this vulnerability by manipulating the options passed to a Node.js application that uses the Tinypool library. By polluting the `Object.prototype`, an attacker can influence how worker threads are initialized, leading to the execution of arbitrary JavaScript code with the privileges of the host process. This could allow an attacker to access sensitive information or compromise the build environment.

Attacker pollutes `Object.prototype`.
Application initializes a worker thread with manipulated options.
Arbitrary JavaScript code execution.

Live Threat

Current exploitation, exposure, and threat context

When supported by the advisory, an attacker who can control properties inherited by a polluted `Object.prototype` could cause Node.js worker threads to load arbitrary JavaScript. This could lead to code execution with the privileges of the host process, potentially exposing sensitive information like CI secrets, signing material, or build artifacts.

Host process code execution and secrets.
Polluting `Object.prototype` before worker creation.
Compromise of sensitive build or signing material.

Operational Fix

Recommended remediation, mitigation, and detection steps

The Platform or Application Engineering team is likely responsible for managing this Node.js worker thread pool implementation. The first practical step is to identify all instances of this library within your environment, determine if they are reachable by an attacker or critical to business operations, and then assign ownership for remediation.

Confirm affected technology deployment.
Verify reachability and business criticality.
Plan remediation with accountable owner.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Tinypool?

Tinypool is a software library for Node.js environments designed to manage worker threads efficiently. It helps developers offload intensive tasks to background threads, which improves application performance and prevents blocking the main process. It is commonly found as a dependency within backend services that require parallel processing, rather than as a standalone application.

What does CWE-1321 mean for CVE-2026-104848?

This CVE involves a weakness known as CWE-1321, or Improperly Controlled Modification of Object Prototype. In plain terms, it means an attacker can inject or modify default properties shared by all objects in the application. Because Tinypool relies on these object configurations to set up background threads, this pollution allows the attacker to inject malicious instructions that the library inadvertently runs.

How is this vulnerability triggered?

An attacker must first successfully pollute the global Object.prototype. If they achieve this, the bug triggers when the application subsequently initializes a new worker thread using Tinypool. Note that the vulnerability does not trigger if the application does not use Tinypool to manage its worker threads, or if the attacker cannot influence the input that leads to the prototype pollution.

Is my system exposed to this CVE?

Halo Surface Signal indicates that exposure is very unlikely because Tinypool is typically used as an internal library within application code, not as an internet-facing service or edge gateway. It is not something that can be targeted directly from the public internet. You should focus your investigation on applications that handle untrusted inputs and utilize Node.js worker threads.

How do I address this security issue?

The primary step is to identify all software components in your environment that rely on Tinypool versions prior to 2.1.1. Once identified, your engineering team should update the library to version 2.1.1 or higher, which contains the necessary security fixes. Coordinate with your application owners to ensure the update is integrated and tested in your service builds.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.