piscina: Prototype-pollution gadget in ThreadPool.options allows RCE via execArgv / loadBalancer / env

Publishers link these advisories through the identifiers shown below. A shared identifier or date alone does not tell you whether your software is affected or whether the advisories describe the same cause.

CVE-2026-102992 · CVE overview and exploitation status

EUVD-2026-90364

GHSA-67c8-pqhq-4rmx

cve-program · CVE-2026-102992

• https://github.com/piscinajs/piscina/security/advisories/GHSA-67c8-pqhq-4rmx
• https://github.com/piscinajs/piscina/commit/0cb12fca37f526065b072592afe954574dcc656f
• https://github.com/piscinajs/piscina/commit/2f69f67159a0e48b38fd61fa4a91c2fdc19fff72
• https://github.com/piscinajs/piscina/commit/5be7bbb19e3787bb698862cd516121a578d690f7
• https://github.com/piscinajs/piscina/commit/bebbda255c2981cecddd36b171b94be2fd41c9a6
• https://github.com/piscinajs/piscina/releases/tag/v4.9.4
• https://github.com/piscinajs/piscina/releases/tag/v5.3.2
• https://github.com/piscinajs/piscina/releases/tag/v6.0.0-rc.5

euvd · EUVD-2026-90364

• https://github.com/piscinajs/piscina/security/advisories/GHSA-67c8-pqhq-4rmx
• https://github.com/piscinajs/piscina/commit/0cb12fca37f526065b072592afe954574dcc656f
• https://github.com/piscinajs/piscina/commit/2f69f67159a0e48b38fd61fa4a91c2fdc19fff72
• https://github.com/piscinajs/piscina/commit/5be7bbb19e3787bb698862cd516121a578d690f7
• https://github.com/piscinajs/piscina/commit/bebbda255c2981cecddd36b171b94be2fd41c9a6
• https://github.com/piscinajs/piscina/releases/tag/v4.9.4
• https://github.com/piscinajs/piscina/releases/tag/v5.3.2
• https://github.com/piscinajs/piscina/releases/tag/v6.0.0-rc.5

nvd · CVE-2026-102992

• https://github.com/piscinajs/piscina/commit/0cb12fca37f526065b072592afe954574dcc656f
• https://github.com/piscinajs/piscina/commit/2f69f67159a0e48b38fd61fa4a91c2fdc19fff72
• https://github.com/piscinajs/piscina/commit/5be7bbb19e3787bb698862cd516121a578d690f7
• https://github.com/piscinajs/piscina/commit/bebbda255c2981cecddd36b171b94be2fd41c9a6
• https://github.com/piscinajs/piscina/releases/tag/v4.9.4
• https://github.com/piscinajs/piscina/releases/tag/v5.3.2
• https://github.com/piscinajs/piscina/releases/tag/v6.0.0-rc.5
• https://github.com/piscinajs/piscina/security/advisories/GHSA-67c8-pqhq-4rmx

osv · GHSA-67c8-pqhq-4rmx

• https://github.com/piscinajs/piscina/security/advisories/GHSA-67c8-pqhq-4rmx
• https://nvd.nist.gov/vuln/detail/CVE-2026-102992
• https://github.com/piscinajs/piscina/commit/0cb12fca37f526065b072592afe954574dcc656f
• https://github.com/piscinajs/piscina/commit/2f69f67159a0e48b38fd61fa4a91c2fdc19fff72
• https://github.com/piscinajs/piscina/commit/5be7bbb19e3787bb698862cd516121a578d690f7
• https://github.com/piscinajs/piscina/commit/bebbda255c2981cecddd36b171b94be2fd41c9a6
• https://github.com/piscinajs/piscina
• https://github.com/piscinajs/piscina/releases/tag/v4.9.4
• https://github.com/piscinajs/piscina/releases/tag/v5.3.2
• https://github.com/piscinajs/piscina/releases/tag/v6.0.0-rc.5

No related changes are available here.