CVE-2026-106448

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-106448

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-106448.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-106448

Aliases

GHSA-w48f-fwg7-ww6p

Published

2026-10-06T19:45:02Z

Modified

2026-10-28T02:30:37Z

Severity

8.9 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:H/SA:N CVSS Calculator

Summary

StableLib: Prototype poisoning via `__proto__` map keys in CBOR decoding

Details

StableLib is a stable library of useful TypeScript and JavaScript code. Prior to 2.0.4, the @stablelib/cbor CBOR map decoding path creates ordinary JavaScript objects and assigns attacker-controlled keys with bracket assignment. A map key named proto invokes the inherited prototype setter instead of creating an ordinary own property, allowing the decoded object's prototype to contain attacker-controlled authorization or feature-flag values. Downstream code that trusts normal property lookup or merges the decoded object can therefore make security-sensitive decisions using inherited attacker data. This issue is fixed in version 2.0.4.

Database specific

{
    "cna_assigner":  "GitHub_M",
    "cwe_ids":  [
        "CWE-1321"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/106xxx/CVE-2026-106448.json"
}

References

Affected packages

Git / github.com/stablelib/stablelib

Affected ranges

Type

GIT

Repo

https://github.com/stablelib/stablelib

Events

Introduced

Fixed

fc5ed95550b1deba7fa2f1418a174fa003546465

Fixed

0f153a63b7552a0e8721f640984113e419015026

Database specific

Show details

{
    "extracted_events":  [
        {
            "range":  [
                {
                    "introduced":  "0"
                },
                {
                    "fixed":  "2.0.4"
                }
            ],
            "source":  "AFFECTED_FIELD",
            "strategy":  "StringRangeExpression"
        },
        {
            "range":  [
                {
                    "fixed":  "0f153a63b7552a0e8721f640984113e419015026"
                }
            ],
            "source":  "REFERENCES_COMMIT"
        }
    ]
}

Affected versions

@stablelib/aead@1.*

@stablelib/aead@1.0.0

@stablelib/aead@1.0.1

@stablelib/aead@2.*

@stablelib/aead@2.0.0

@stablelib/aes-kw@1.*

@stablelib/aes-kw@1.0.0

@stablelib/aes-kw@1.0.1

@stablelib/aes-kw@2.*

@stablelib/aes-kw@2.0.0

@stablelib/aes-kw@2.0.1

@stablelib/aes@0.*

@stablelib/aes@0.7.3

@stablelib/aes@1.*

@stablelib/aes@1.0.0

@stablelib/aes@1.0.1

@stablelib/aes@2.*

@stablelib/aes@2.0.0

@stablelib/aes@2.0.1

@stablelib/base64@1.*

@stablelib/base64@1.0.0

@stablelib/base64@1.0.1

@stablelib/base64@2.*

@stablelib/base64@2.0.0

@stablelib/base64@2.0.1

@stablelib/benchmark@1.*

@stablelib/benchmark@1.0.0

@stablelib/benchmark@1.0.1

@stablelib/benchmark@2.*

@stablelib/benchmark@2.0.0

@stablelib/binary@1.*

@stablelib/binary@1.0.0

@stablelib/binary@1.0.1

@stablelib/binary@2.*

@stablelib/binary@2.0.0

@stablelib/binary@2.0.1

@stablelib/blake2b@0.*

@stablelib/blake2b@0.10.7

@stablelib/blake2b@1.*

@stablelib/blake2b@1.0.0

@stablelib/blake2b@1.0.1

@stablelib/blake2b@2.*

@stablelib/blake2b@2.0.0

@stablelib/blake2b@2.0.1

@stablelib/blake2s@1.*

@stablelib/blake2s@1.0.0

@stablelib/blake2s@1.0.1

@stablelib/blake2s@2.*

@stablelib/blake2s@2.0.0

@stablelib/blake2s@2.0.1

@stablelib/blake2xs@1.*

@stablelib/blake2xs@1.0.0

@stablelib/blake2xs@1.0.1

@stablelib/blake2xs@2.*

@stablelib/blake2xs@2.0.0

@stablelib/blake2xs@2.0.1

@stablelib/blockcipher@1.*

@stablelib/blockcipher@1.0.0

@stablelib/blockcipher@1.0.1

@stablelib/blockcipher@2.*

@stablelib/blockcipher@2.0.0

@stablelib/bytereader@1.*

@stablelib/bytereader@1.0.0

@stablelib/bytereader@1.0.1

@stablelib/bytereader@2.*

@stablelib/bytereader@2.0.0

@stablelib/bytereader@2.0.1

@stablelib/bytes@1.*

@stablelib/bytes@1.0.0

@stablelib/bytes@1.0.1

@stablelib/bytes@2.*

@stablelib/bytes@2.0.0

@stablelib/bytes@2.0.1

@stablelib/bytewriter@1.*

@stablelib/bytewriter@1.0.0

@stablelib/bytewriter@1.0.1

@stablelib/bytewriter@2.*

@stablelib/bytewriter@2.0.0

@stablelib/bytewriter@2.0.1

@stablelib/cbor@1.*

@stablelib/cbor@1.0.0

@stablelib/cbor@1.0.1

@stablelib/cbor@1.0.2

@stablelib/cbor@2.*

@stablelib/cbor@2.0.0

@stablelib/cbor@2.0.1

@stablelib/cbor@2.0.2

@stablelib/chacha-drbg@0.*

@stablelib/chacha-drbg@0.7.3

@stablelib/chacha-drbg@0.7.4

@stablelib/chacha-drbg@1.*

@stablelib/chacha-drbg@1.0.0

@stablelib/chacha-drbg@1.0.1

@stablelib/chacha-drbg@1.0.2

@stablelib/chacha-drbg@1.0.3

@stablelib/chacha-drbg@2.*

@stablelib/chacha-drbg@2.0.0

@stablelib/chacha-drbg@2.0.1

@stablelib/chacha20poly1305@0.*

@stablelib/chacha20poly1305@0.10.3

@stablelib/chacha20poly1305@1.*

@stablelib/chacha20poly1305@1.0.0

@stablelib/chacha20poly1305@1.0.1

@stablelib/chacha20poly1305@2.*

@stablelib/chacha20poly1305@2.0.0

@stablelib/chacha20poly1305@2.0.1

@stablelib/chacha@1.*

@stablelib/chacha@1.0.0

@stablelib/chacha@1.0.1

@stablelib/chacha@2.*

@stablelib/chacha@2.0.0

@stablelib/chacha@2.0.1

@stablelib/cmac@0.*

@stablelib/cmac@0.7.3

@stablelib/cmac@1.*

@stablelib/cmac@1.0.0

@stablelib/cmac@1.0.1

@stablelib/cmac@2.*

@stablelib/cmac@2.0.0

@stablelib/cmac@2.0.1

@stablelib/constant-time@1.*

@stablelib/constant-time@1.0.0

@stablelib/constant-time@1.0.1

@stablelib/constant-time@2.*

@stablelib/constant-time@2.0.0

@stablelib/constant-time@2.0.1

@stablelib/ctr@0.*

@stablelib/ctr@0.8.0

@stablelib/ctr@1.*

@stablelib/ctr@1.0.0

@stablelib/ctr@1.0.1

@stablelib/ctr@1.0.2

@stablelib/ctr@2.*

@stablelib/ctr@2.0.0

@stablelib/ctr@2.0.1

@stablelib/ed25519@0.*

@stablelib/ed25519@0.10.8

@stablelib/ed25519@0.10.9

@stablelib/ed25519@0.11.0

@stablelib/ed25519@1.*

@stablelib/ed25519@1.0.0

@stablelib/ed25519@1.0.1

@stablelib/ed25519@1.0.2

@stablelib/ed25519@1.0.3

@stablelib/ed25519@2.*

@stablelib/ed25519@2.0.0

@stablelib/ed25519@2.0.1

@stablelib/ed25519@2.0.2

@stablelib/ed25519@2.1.0

@stablelib/float@1.*

@stablelib/float@1.0.0

@stablelib/float@1.0.1

@stablelib/float@2.*

@stablelib/float@2.0.0

@stablelib/float@2.0.1

@stablelib/gcm@0.*

@stablelib/gcm@0.7.3

@stablelib/gcm@1.*

@stablelib/gcm@1.0.0

@stablelib/gcm@1.0.1

@stablelib/gcm@1.0.2

@stablelib/gcm@2.*

@stablelib/gcm@2.0.0

@stablelib/gcm@2.0.1

@stablelib/gf256@1.*

@stablelib/gf256@1.0.0

@stablelib/gf256@1.0.1

@stablelib/gf256@2.*

@stablelib/gf256@2.0.0

@stablelib/gf256@2.0.1

@stablelib/halfsiphash@1.*

@stablelib/halfsiphash@1.0.0

@stablelib/halfsiphash@1.0.1

@stablelib/halfsiphash@2.*

@stablelib/halfsiphash@2.0.0

@stablelib/halfsiphash@2.0.1

@stablelib/hash@1.*

@stablelib/hash@1.0.0

@stablelib/hash@1.0.1

@stablelib/hash@2.*

@stablelib/hash@2.0.0

@stablelib/hex@1.*

@stablelib/hex@1.0.0

@stablelib/hex@1.0.1

@stablelib/hex@2.*

@stablelib/hex@2.0.0

@stablelib/hex@2.0.1

@stablelib/hkdf@0.*

@stablelib/hkdf@0.7.3

@stablelib/hkdf@1.*

@stablelib/hkdf@1.0.0

@stablelib/hkdf@1.0.1

@stablelib/hkdf@2.*

@stablelib/hkdf@2.0.0

@stablelib/hkdf@2.0.1

@stablelib/hmac-drbg@0.*

@stablelib/hmac-drbg@0.7.3

@stablelib/hmac-drbg@0.7.4

@stablelib/hmac-drbg@1.*

@stablelib/hmac-drbg@1.0.0

@stablelib/hmac-drbg@1.0.1

@stablelib/hmac-drbg@1.0.2

@stablelib/hmac-drbg@2.*

@stablelib/hmac-drbg@2.0.0

@stablelib/hmac-drbg@2.0.1

@stablelib/hmac@0.*

@stablelib/hmac@0.7.3

@stablelib/hmac@1.*

@stablelib/hmac@1.0.0

@stablelib/hmac@1.0.1

@stablelib/hmac@2.*

@stablelib/hmac@2.0.0

@stablelib/hmac@2.0.1

@stablelib/int@1.*

@stablelib/int@1.0.0

@stablelib/int@1.0.1

@stablelib/int@2.*

@stablelib/int@2.0.0

@stablelib/int@2.0.1

@stablelib/keyagreement@0.*

@stablelib/keyagreement@0.5.1

@stablelib/keyagreement@1.*

@stablelib/keyagreement@1.0.0

@stablelib/keyagreement@1.0.1

@stablelib/keyagreement@2.*

@stablelib/keyagreement@2.0.0

@stablelib/keyagreement@2.0.1

@stablelib/nacl@0.*

@stablelib/nacl@0.10.3

@stablelib/nacl@0.10.4

@stablelib/nacl@0.10.5

@stablelib/nacl@1.*

@stablelib/nacl@1.0.0

@stablelib/nacl@1.0.1

@stablelib/nacl@1.0.2

@stablelib/nacl@1.0.3

@stablelib/nacl@1.0.4

@stablelib/nacl@2.*

@stablelib/nacl@2.0.0

@stablelib/nacl@2.0.1

@stablelib/newhope@0.*

@stablelib/newhope@0.8.0

@stablelib/newhope@0.8.1

@stablelib/newhope@0.8.2

@stablelib/newhope@1.*

@stablelib/newhope@1.0.0

@stablelib/newhope@1.0.1

@stablelib/newhope@1.0.2

@stablelib/newhope@2.*

@stablelib/newhope@2.0.0

@stablelib/newhope@2.0.1

@stablelib/pbkdf2@0.*

@stablelib/pbkdf2@0.7.3

@stablelib/pbkdf2@1.*

@stablelib/pbkdf2@1.0.0

@stablelib/pbkdf2@1.0.1

@stablelib/pbkdf2@2.*

@stablelib/pbkdf2@2.0.0

@stablelib/pbkdf2@2.0.1

@stablelib/poly1305@1.*

@stablelib/poly1305@1.0.0

@stablelib/poly1305@1.0.1

@stablelib/poly1305@2.*

@stablelib/poly1305@2.0.0

@stablelib/poly1305@2.0.1

@stablelib/random@0.*

@stablelib/random@0.7.3

@stablelib/random@0.7.4

@stablelib/random@1.*

@stablelib/random@1.0.0

@stablelib/random@1.0.1

@stablelib/random@1.0.2

@stablelib/random@2.*

@stablelib/random@2.0.0

@stablelib/random@2.0.1

@stablelib/salsa20@1.*

@stablelib/salsa20@1.0.0

@stablelib/salsa20@1.0.1

@stablelib/salsa20@1.0.2

@stablelib/salsa20@2.*

@stablelib/salsa20@2.0.0

@stablelib/salsa20@2.0.1

@stablelib/scrypt@0.*

@stablelib/scrypt@0.10.2

@stablelib/scrypt@0.10.3

@stablelib/scrypt@1.*

@stablelib/scrypt@1.0.0

@stablelib/scrypt@1.0.1

@stablelib/scrypt@1.0.2

@stablelib/scrypt@1.0.3

@stablelib/scrypt@2.*

@stablelib/scrypt@2.0.0

@stablelib/scrypt@2.0.1

@stablelib/scrypt@2.0.2

@stablelib/sha224@1.*

@stablelib/sha224@1.0.0

@stablelib/sha224@1.0.1

@stablelib/sha224@2.*

@stablelib/sha224@2.0.0

@stablelib/sha224@2.0.1

@stablelib/sha256@1.*

@stablelib/sha256@1.0.0

@stablelib/sha256@1.0.1

@stablelib/sha256@2.*

@stablelib/sha256@2.0.0

@stablelib/sha256@2.0.1

@stablelib/sha384@1.*

@stablelib/sha384@1.0.0

@stablelib/sha384@1.0.1

@stablelib/sha384@2.*

@stablelib/sha384@2.0.0

@stablelib/sha384@2.0.1

@stablelib/sha3@1.*

@stablelib/sha3@1.0.0

@stablelib/sha3@1.0.1

@stablelib/sha3@2.*

@stablelib/sha3@2.0.0

@stablelib/sha3@2.0.1

@stablelib/sha512@1.*

@stablelib/sha512@1.0.0

@stablelib/sha512@1.0.1

@stablelib/sha512@2.*

@stablelib/sha512@2.0.0

@stablelib/sha512@2.0.1

@stablelib/sha512_256@1.*

@stablelib/sha512_256@1.0.0

@stablelib/sha512_256@1.0.1

@stablelib/sha512_256@2.*

@stablelib/sha512_256@2.0.0

@stablelib/sha512_256@2.0.1

@stablelib/siv@0.*

@stablelib/siv@0.7.3

@stablelib/siv@1.*

@stablelib/siv@1.0.0

@stablelib/siv@1.0.1

@stablelib/siv@1.0.2

@stablelib/siv@2.*

@stablelib/siv@2.0.0

@stablelib/siv@2.0.1

@stablelib/snappy@1.*

@stablelib/snappy@1.0.0

@stablelib/snappy@1.0.1

@stablelib/snappy@1.0.2

@stablelib/snappy@1.0.3

@stablelib/snappy@2.*

@stablelib/snappy@2.0.0

@stablelib/snappy@2.0.1

@stablelib/snappy@2.0.2

@stablelib/tss@0.*

@stablelib/tss@0.7.3

@stablelib/tss@0.7.4

@stablelib/tss@1.*

@stablelib/tss@1.0.0

@stablelib/tss@1.0.1

@stablelib/tss@1.0.2

@stablelib/tss@2.*

@stablelib/tss@2.0.0

@stablelib/tss@2.0.1

@stablelib/utf8@1.*

@stablelib/utf8@1.0.0

@stablelib/utf8@1.0.1

@stablelib/utf8@1.0.2

@stablelib/utf8@2.*

@stablelib/utf8@2.0.0

@stablelib/utf8@2.0.1

@stablelib/utf8@2.1.0

@stablelib/uuid@0.*

@stablelib/uuid@0.7.3

@stablelib/uuid@0.7.4

@stablelib/uuid@1.*

@stablelib/uuid@1.0.0

@stablelib/uuid@1.0.1

@stablelib/uuid@1.0.2

@stablelib/uuid@2.*

@stablelib/uuid@2.0.0

@stablelib/uuid@2.0.1

@stablelib/wipe@1.*

@stablelib/wipe@1.0.0

@stablelib/wipe@1.0.1

@stablelib/wipe@2.*

@stablelib/wipe@2.0.0

@stablelib/wipe@2.0.1

@stablelib/x25519-session@1.*

@stablelib/x25519-session@1.0.4

@stablelib/x25519-session@2.*

@stablelib/x25519-session@2.0.0

@stablelib/x25519-session@2.0.1

@stablelib/x25519@0.*

@stablelib/x25519@0.7.3

@stablelib/x25519@0.7.4

@stablelib/x25519@0.7.5

@stablelib/x25519@1.*

@stablelib/x25519@1.0.0

@stablelib/x25519@1.0.1

@stablelib/x25519@1.0.2

@stablelib/x25519@1.0.3

@stablelib/x25519@2.*

@stablelib/x25519@2.0.0

@stablelib/x25519@2.0.1

@stablelib/xchacha20@0.*

@stablelib/xchacha20@0.1.1

@stablelib/xchacha20@1.*

@stablelib/xchacha20@1.0.0

@stablelib/xchacha20@1.0.1

@stablelib/xchacha20@2.*

@stablelib/xchacha20@2.0.0

@stablelib/xchacha20@2.0.1

@stablelib/xchacha20poly1305@0.*

@stablelib/xchacha20poly1305@0.1.1

@stablelib/xchacha20poly1305@1.*

@stablelib/xchacha20poly1305@1.0.0

@stablelib/xchacha20poly1305@1.0.1

@stablelib/xchacha20poly1305@2.*

@stablelib/xchacha20poly1305@2.0.0

@stablelib/xchacha20poly1305@2.0.1

@stablelib/xsalsa20@1.*

@stablelib/xsalsa20@1.0.0

@stablelib/xsalsa20@1.0.1

@stablelib/xsalsa20@1.0.2

@stablelib/xsalsa20@2.*

@stablelib/xsalsa20@2.0.0

@stablelib/xsalsa20@2.0.1

v0.*

v0.0.1

v0.0.2

v0.1.0

v0.1.1

v0.1.2

v0.10.0

v0.10.1

v0.10.2

v0.10.3

v0.10.4

v0.10.5

v0.10.6

v0.10.7

v0.2.0

v0.2.1

v0.2.2

v0.2.3

v0.2.4

v0.2.5

v0.3.0

v0.3.1

v0.3.2

v0.4.0

v0.4.1

v0.5.0

v0.6.0

v0.7.0

v0.7.1

v0.7.2

v0.7.3

v0.8.0

v0.8.1

v0.8.2

v0.9.0

v2.*

v2.0.0

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-106448.json"