External risk intelligence

Tinypool Prototype Pollution Leads to Remote Code Execution.

CVE advisorySeverity: CRITICAL (CVSS 9.5)

CVE-2026-104849

Tinypool is an internal Node.js library, not an internet-facing application. Exploitation requires achieving prototype pollution followed by specific application-level calls to pool.run() using user-controlled options. Because it is a backend dependency and not a service, direct exposure to the public internet is inherently unlikely.

Code Injection

Halo Surface Signal: 1 out of 5 — much less likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A vulnerability exists in the Tinypool Node.js library that could allow an attacker to load malicious JavaScript, potentially leading to unauthorized access or modification of task data. This issue arises from how the library handles caller-supplied options when running tasks, and it is fixed in version 2.1.2. The primary concern for leadership is to confirm if this library is in use and understand the potential exposure.

A coding flaw lets attackers run malicious code.
It affects a backend Node.js library.
Confirm relevance and assess potential exposure.

Attack Path

How an attacker could exploit the issue

An attacker could execute arbitrary JavaScript on a server by manipulating the `filename` property through prototype pollution. This requires an attacker to first gain the ability to modify the `Object.prototype` and then ensure the vulnerable application calls `pool.run()` with a specially crafted options object. If successful, the attacker could compromise the host process.

Attacker pollutes `Object.prototype`.
Application calls `pool.run()` with options.
Risk of host process compromise.

Live Threat

Current exploitation, exposure, and threat context

When supported by the advisory, this vulnerability could allow an attacker to execute arbitrary JavaScript within the worker pool, potentially leading to unauthorized access or modification of task data. This risk exists when an application passes a custom options object to the `pool.run()` function and an attacker has previously polluted the `Object.prototype`.

Worker pool code execution.
Prototype pollution via custom options.
Unauthorized access to task data.

Operational Fix

Recommended remediation, mitigation, and detection steps

To address this vulnerability, application owners are likely responsible for identifying and managing their Node.js dependencies, while platform or infrastructure teams may oversee the environment where these applications run. The first practical step is to locate applications utilizing Tinypool, confirm if they pass custom options to `pool.run()`, and assess their criticality and exposure before planning remediation.

Application owners should own the issue.
Verify custom options are passed to `pool.run()`.
Plan remediation based on application risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Tinypool and how is it used in software development?

Tinypool is a utility library for Node.js designed to manage a pool of worker threads. Developers use it to run computationally intensive tasks in parallel without blocking the main event loop, which helps improve the performance and responsiveness of backend applications.

What is the vulnerability in CVE-2026-104849?

This CVE involves Improper Control of Generation of Code and Prototype Pollution. The library incorrectly checks the options object provided to it, allowing an attacker to inject a malicious 'filename' property. By influencing the prototype of JavaScript objects, an attacker can trick the library into running unauthorized code instead of the intended worker script.

How does an attacker trigger this vulnerability?

An attacker must first perform prototype pollution to modify the base Object configuration in the application's memory. Even then, the bug only activates if the application specifically passes a custom options object as a second argument to the 'pool.run()' function. Calls that use the default, trusted options object are not affected by this flaw.

Is my application at risk if it uses Tinypool?

Halo Surface Signal identifies Tinypool as an internal Node.js library rather than a public-facing service, making direct internet exploitation very unlikely. You should evaluate if your application code is reachable by untrusted input, as the library itself is typically hidden deep within backend infrastructure.

How do I address CVE-2026-104849 in my projects?

The most effective resolution is to update your Tinypool dependency to version 2.1.2 or later. Prior to updating, you can review your source code to identify where 'pool.run()' is called; if you are passing custom options objects, prioritize auditing those specific integrations for potential prototype pollution vectors.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.