Fcmam5

Mongoose uses attacker-controlled discriminator key values, including the default ` t` field, to index plain-object registries like `Model.discriminators` and `schema.discriminators` without verifying if the property belongs to the object itself. This allows values such as `constructor`, `toString`, or `hasOwnProperty` to resolve to inherited built-in functions rather than a registered discriminator. This leads to type confusion during model construction, document creation, hydration, query and update casting, embedded discriminators, and populate operations. Additionally, in the `bulkWrite()` `insertOne` path when `skipValidation` is enabled, using a `constructor` value can result in a raw input object being stored without schema casting or strict filtering. A poisoned document stored in this manner can cause all subsequent queries that hydrate it to fail until the document is deleted.

This issue occurs because the software stores `ThreadPool.options` as a plain object that inherits from `Object.prototype`. When a separate prototype pollution primitive is present, an attacker can supply inherited values for security-sensitive options that lack their own defaults. This can lead to the following impacts: - An inherited `execArgv` value passed to the Node.js Worker constructor may preload attacker-controlled code in worker threads. - An inherited `loadBalancer` function may execute during task scheduling. - Inherited `env` values may alter worker environments.

Tinypool reads the filename from a caller-supplied options object in the `pool.run(task, options)` function without verifying if the property is an own property of the object. This allows a polluted `Object.prototype.filename` to replace the intended worker module. Applications are affected when a custom options object is passed as the second argument to `pool.run()`. An attacker capable of prototype pollution can force the worker pool to load arbitrary JavaScript, enabling them to read or modify task data using the privileges of the host process.

When the `qs.parse` function is used with the `comma` and `throwOnLimitExceeded` options set to `true`, a comma-separated value assigned to a bracket-push key (e.g., `a[]=1,2,3,4`) is split into an array without being validated against the `arrayLimit`. In contrast, the same value assigned to flat, indexed, nested, or dotted keys correctly triggers a `RangeError`. This occurs because the `arrayLimit` check in `lib/parse.js` was applied after the value was wrapped as a nested element, and a subsequent attempt to fix this using an `isFlatArrayValue` flag failed to account for the `[]=` key form. An unauthenticated attacker can exploit this by providing a single `a[]=` parameter to bypass configured limits and force the parser to allocate an array proportional to the request size, potentially leading to excessive memory consumption.