piscina: Prototype-pollution gadget in ThreadPool.options allows RCE via execArgv / loadBalancer / env (Critical severity, CVE-2026-102992)
A critical-severity advisory for the npm package piscina is fixed in version 5.3.2.
Key points
- piscina (npm) has a critical flaw.
- Tracked as CVE-2026-102992.
- Version 5.3.2.
Maintainers of piscina, a package in the npm ecosystem, have published a critical-severity security advisory (CVE-2026-102992): piscina: Prototype-pollution gadget in ThreadPool.options allows RCE via execArgv / loadBalancer / env.
At a glance
- Advisory
- GHSA-67c8-pqhq-4rmx
- CVE
- CVE-2026-102992
- Package
- piscina (npm)
- Severity
- Critical
- Patched in
- 5.3.2
What is the issue?
The GitHub-reviewed advisory explains: Summary A prototype-pollution gadget in ThreadPool.options allows an attacker who can pollute Object.prototype to execute arbitrary code in Piscina worker threads, invoke arbitrary functions during task scheduling, or inject environment variables into workers. The root cause is that ThreadPool.options is created as a plain object inheriting from Object.prototype, so any option without an explicit default in kDefaultOptions can be supplied via the prototype chain. Details In src/index.ts the ThreadPool constructor builds the resolved options object as a plain object: ts this.options = { ...kDefaultOptions, ...options, filename, maxQueue: 0 } Because this object has Object.prototype as its prototype, reads for properties that are not own properties of the object and are not present in kDefaultOptions fall back to Object.prototype. This means a prototype-pollution primitive (e.g. from a vul
Affected versions
| Ecosystem | Package | Vulnerable | Patched |
|---|---|---|---|
| npm | piscina | >= 5.0.0, < 5.3.2 | 5.3.2 |
| npm | piscina | < 4.9.4 | 4.9.4 |
| npm | piscina | >= 6.0.0-rc.1, < 6.0.0-rc.5 | 6.0.0-rc.5 |
How to fix it
- Upgrade the affected package to the first patched version listed above.
- Rebuild and redeploy applications that bundle the vulnerable dependency.
- Run your dependency scanner (npm audit, pip-audit, Dependabot) to find transitive uses.
- Review the advisory references for workaround details if you cannot upgrade yet.
What to do and how to stay safe: CVE-2026-102992
- Patch scores alone ignore context like network exposure and asset criticality.
- You must map vulnerabilities to specific business risks to prioritize correctly.
- Continuous exposure data replaces static scanning for accurate prioritization.
Prioritize vulnerabilities by actual exploitability and business impact, not by theoretical severity scores. Update your asset context and exposure data continuously to maintain accurate risk rankings.
Step-by-step guide: Risk Based Vulnerability Management: Prioritize Fixes by Actual Threat
General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is CVE-2026-102992?
CVE-2026-102992 is a security vulnerability in piscina (npm).
Which version fixes CVE-2026-102992?
The fix is in version 5.3.2.
