Trigger.dev: Prototype pollution via run metadata operations → process-wide cross-tenant DoS

Publishers link these advisories through the identifiers shown below. A shared identifier or date alone does not tell you whether your software is affected or whether the advisories describe the same cause.

CVE-2026-73654 · CVE overview and exploitation status

EUVD-2026-58358

GHSA-p28v-f755-9qrg

cve-program · CVE-2026-73654

• https://github.com/triggerdotdev/trigger.dev/security/advisories/GHSA-p28v-f755-9qrg
• https://github.com/triggerdotdev/trigger.dev/pull/4316
• https://github.com/triggerdotdev/trigger.dev/commit/6997aeb05e27d2db47f9eda01fdc8a17c81a1ae0
• https://github.com/triggerdotdev/trigger.dev/releases/tag/v4.5.6

euvd · EUVD-2026-58358

• https://github.com/triggerdotdev/trigger.dev/security/advisories/GHSA-p28v-f755-9qrg
• https://github.com/triggerdotdev/trigger.dev/pull/4316
• https://github.com/triggerdotdev/trigger.dev/commit/6997aeb05e27d2db47f9eda01fdc8a17c81a1ae0
• https://github.com/triggerdotdev/trigger.dev/releases/tag/v4.5.6

nvd · CVE-2026-73654

• https://github.com/triggerdotdev/trigger.dev/commit/6997aeb05e27d2db47f9eda01fdc8a17c81a1ae0
• https://github.com/triggerdotdev/trigger.dev/pull/4316
• https://github.com/triggerdotdev/trigger.dev/releases/tag/v4.5.6
• https://github.com/triggerdotdev/trigger.dev/security/advisories/GHSA-p28v-f755-9qrg

osv · GHSA-p28v-f755-9qrg

• https://github.com/triggerdotdev/trigger.dev/security/advisories/GHSA-p28v-f755-9qrg
• https://github.com/triggerdotdev/trigger.dev/pull/4316
• https://github.com/triggerdotdev/trigger.dev/commit/6997aeb05e27d2db47f9eda01fdc8a17c81a1ae0
• https://github.com/triggerdotdev/trigger.dev
• https://github.com/triggerdotdev/trigger.dev/releases/tag/v4.5.6

No related changes are available here.