CVE-2026-106448

StableLib is a stable library of useful TypeScript and JavaScript code. Prior to 2.0.4, the @stablelib/cbor CBOR map decoding path creates ordinary JavaScript objects and assigns attacker-controlled keys with bracket assignment. A map key named __proto__ invokes the inherited prototype setter instead of creating an ordinary own property, allowing the decoded object's prototype to contain attacker-controlled authorization or feature-flag values. Downstream code that trusts normal property lookup or merges the decoded object can therefore make security-sensitive decisions using inherited attacker data. This issue is fixed in version 2.0.4.

• CWE-1321

• https://github.com/StableLib/stablelib/commit/0f153a63b7552a0e8721f640984113e419015026
• https://github.com/StableLib/stablelib/releases/tag/@stablelib/cbor@2.0.4
• https://github.com/StableLib/stablelib/security/advisories/GHSA-w48f-fwg7-ww6p

Published

Oct 6, 2026

Last Modified

Oct 7, 2026

Status

Awaiting Analysis

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-106442Hydra is a framework for elegantly configuring complex appli…7.8
• CVE-2026-106443WeasyPrint helps web developers to create PDF documents. Pri…8.8
• CVE-2026-106444Handlebars provides the power necessary to let users build s…4.7
• CVE-2026-106445Handlebars provides the power necessary to let users build s…9.2
• CVE-2026-106446Handlebars provides the power necessary to let users build s…9.8
• CVE-2026-106447StableLib is a stable library of useful TypeScript and JavaS…8.7
• CVE-2026-106449yawkat LZ4 Java provides LZ4 compression for Java. Prior to …3.7
• CVE-2026-10645The Zephyr ext2 filesystem driver (subsys/fs/ext2) trusted t…5.5
• CVE-2026-106450yawkat LZ4 Java provides LZ4 compression for Java. Prior to …5.3
• CVE-2026-106451yawkat LZ4 Java provides LZ4 compression for Java. From 1.7.…7.3
• CVE-2026-106452yawkat LZ4 Java provides LZ4 compression for Java. Prior to …5.3
• CVE-2026-106453yawkat LZ4 Java provides LZ4 compression for Java. Prior to …5.3