CVE-2026-16266

Name of the Vulnerable Software and Affected Versions mongo-object versions prior to 3.0.3

Description Prototype Pollution occurs via the expandKey() function in util.js. An attacker can modify the JavaScript prototype chain by supplying a crafted property path containing special keys such as proto. Prototype Pollution is a vulnerability where an attacker can manipulate the base object prototype of a JavaScript application, potentially leading to unexpected behavior or remote code execution.

Recommendations Update mongo-object to version 3.0.3 or later. As a temporary workaround, restrict the use of the expandKey() function until the update is applied.