piscina vulnerabilities
CVEs whose affected-version data names the piscina package (npm). Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.
2 CVEsRSS
CVE-2026-102992Critical· 9.2PoCpiscina is a node.js worker pool implementation
piscina is a node.js worker pool implementation. Prior to 4.9.4, 5.3.2, and 6.0.0-rc.5, Piscina stores ThreadPool.options in src/index.ts as a plain object that inherits from Object.prototype. Applications with a separate prototype-pollu…
▾ Abyssalpiscinajs · piscinaEPSS 0.51%via NVD
CVE-2026-55388High· 8.1piscina: Prototype Pollution Gadget → RCE via inherited options.filename
piscina: Prototype Pollution Gadget → RCE via inherited options.filename
▾ Twilightpiscina · piscinaEPSS 0.48%via GHSA