Product
An unauthenticated-accessible prototype pollution vulnerability in the Trigger.dev metadata API allows low-privileged attackers to corrupt the global object, leading to cross-tenant denial of service and process crashes via CVE-2026-73654.