Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
9.5

tinypool can let attackers run unauthorized code

CVE-2026-104849 · published 2 days ago
Summary

The tinypool library used in Node.js projects contained a flaw that could allow an attacker to execute code with the same rights as the application. This matters because it could lead to data loss or system compromise. Apply the latest patched version of tinypool from the vendor to resolve the issue.

What to do
  • Update tinypool to version 2.1.2.
  • Update tinypool to version 1.1.1-aikido.3.
  • Update rootio @rootio/tinypool to version 1.1.1-root.io.3.
Affected software
Ecosystem VendorProductAffected versions
– tinylibs tinypool < 2.1.2
npm – tinypool < 2.1.2
Fix: upgrade to 2.1.2
Root:npm – tinypool < 1.1.1-aikido.3
Fix: upgrade to 1.1.1-aikido.3
Root:npm rootio @rootio/tinypool < 1.1.1-root.io.3
Fix: upgrade to 1.1.1-root.io.3
Original advisory text
CVE-2026-104849 in tinypool - Patched by Root
Root has patched CVE-2026-104849 in the tinypool package for Root:npm. Multiple fixed versions available.
References
Fix within
Internet-facing 3 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically
  • Gives an attacker full control
Severity
9.5 Critical
Exploitation
<1% chance of attack within 30 days
Type
CWE-94Code Injection
CWE-1321Prototype Pollution
Timeline
Published13 Oct 2026
Updated15 Oct 2026
First seen2 Oct 2026
Sources
CVE-2026-104849 · NVD
CVE-2026-104849 · OSV
GHSA-85c8-ppgw-ccpr · GHSA
GHSA-85c8-ppgw-ccpr · OSV
CVE-2026-104849 · MITRE
ROOT-APP-NPM-CVE-2026-104849 · OSV
Track software like this
Free during beta