Skip to content
Threat Feed
Subscribe

CPE

Cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*

1 brief RSS
medium advisory

Prototype Pollution Vulnerability in Node.js JSON Merge Patch Implementations

A prototype pollution vulnerability, tracked as CVE-2026-3030, allows attackers to inject malicious properties into the global Object.prototype via insecure deep merge functions, potentially leading to privilege escalation.

Node.js web-application-security prototype-pollution nodejs privilege-escalation
1r 1t