Fcmam5

**Name of the Vulnerable Software and Affected Versions** Tinypool versions prior to 2.1.2 **Description** Tinypool reads the filename from a caller-supplied options object in the `pool.run(task, options)` function without verifying if the property is an own property of the object. This allows a polluted `Object.prototype.filename` to replace the intended worker module. Applications are affected when a custom options object is passed as the second argument to `pool.run()`. An attacker capable of prototype pollution can force the worker pool to load arbitrary JavaScript, enabling them to read or modify task data using the privileges of the host process. **Recommendations** Update to version 2.1.2.

**Name of the Vulnerable Software and Affected Versions** piscina versions prior to 4.9.4 piscina versions prior to 5.3.2 piscina versions prior to 6.0.0-rc.5 **Description** This issue occurs because the software stores `ThreadPool.options` as a plain object that inherits from `Object.prototype`. When a separate prototype pollution primitive is present, an attacker can supply inherited values for security-sensitive options that lack their own defaults. This can lead to the following impacts: - An inherited `execArgv` value passed to the Node.js Worker constructor may preload attacker-controlled code in worker threads. - An inherited `loadBalancer` function may execute during task scheduling. - Inherited `env` values may alter worker environments. **Recommendations** Update to version 4.9.4. Update to version 5.3.2. Update to version 6.0.0-rc.5.

**Name of the Vulnerable Software and Affected Versions** qs versions 6.14.2 through 6.15.3 **Description** When the `qs.parse` function is used with the `comma` and `throwOnLimitExceeded` options set to `true`, a comma-separated value assigned to a bracket-push key (e.g., `a[]=1,2,3,4`) is split into an array without being validated against the `arrayLimit`. In contrast, the same value assigned to flat, indexed, nested, or dotted keys correctly triggers a `RangeError`. This occurs because the `arrayLimit` check in `lib/parse.js` was applied after the value was wrapped as a nested element, and a subsequent attempt to fix this using an `isFlatArrayValue` flag failed to account for the `[]=` key form. An unauthenticated attacker can exploit this by providing a single `a[]=` parameter to bypass configured limits and force the parser to allocate an array proportional to the request size, potentially leading to excessive memory consumption. **Recommendations** Update qs to version 6.16.0. As a temporary workaround, avoid using the `[]=` key form in query strings when `comma` and `throwOnLimitExceeded` are enabled.