PT-2026-139842

CVE-2026-123561

Published

2026-10-01

Updated

2026-11-08

Description by

CVSS 4.0

6.3

Medium

MetricsAV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N

Name of the Vulnerable Software and Affected Versions devalue versions prior to 5.9.3

Description Malformed null-prototype object keys can bypass the rejection of proto during parsing through property-key coercion. This occurs because of an incomplete fix for a previous issue. Attackers can provide crafted payloads that result in objects containing a proto own property, although this action alone does not lead to prototype pollution.

Recommendations Update to version 5.9.3 or later.

Exploitability

Exploit

Fix

Impacts

Researchers

Vendors

Affected products

Weakness enumeration

CWE-1321: Improperly Controlled Modification of Object Prototype Attributes (\'Prototype Pollution\')

Related identifiers

CVE-2026-123561