piscina is a node.js worker pool implementation. Prior to 4.9.4, 5.3.2, and 6.0.0-rc.5, Piscina stores ThreadPool.options in src/index.ts as a plain object that inherits from Object.prototype. Applications with a separate prototype-pollution primitive can therefore supply inherited values for security-sensitive options that do not have own defaults. An inherited execArgv value is passed to the Node.js Worker constructor and can preload attacker-controlled code in worker threads, an inherited loadBalancer function can execute during task scheduling, and inherited env values can alter worker environments. This issue is fixed in versions 4.9.4, 5.3.2, and 6.0.0-rc.5.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - piscina is a node.js worker pool implementation. Prior to 4.9.4, 5.3.2, and 6.0.0-rc.5, Piscina stores
    ThreadPool.options in src/index.ts as a plain object that inherits from Object.prototype. Applications
    with a separate prototype-pollution primitive can therefore supply inherited values for security-sensitive
    options that do not have own defaults. An inherited execArgv value is passed to the Node.js Worker
    constructor and can preload attacker-controlled code in worker threads, an inherited loadBalancer function
    can execute during task scheduling, and inherited env values can alter worker environments. This issue is
    fixed in versions 4.9.4, 5.3.2, and 6.0.0-rc.5. (CVE-2026-102992)

ID	Name	Product	Family	Type	Severity
472277	Echo: piscina: security update to 4.9.4	Tenable Cloud Security	Echo Local Security Checks	Local	critical
472277	Echo: piscina: security update to 4.9.4	Tenable Self-Hosted Container Security	Echo Local Security Checks	Local	critical
455124	SCA: security update for piscina (GHSA-67c8-pqhq-4rmx)	Tenable Cloud Security	SCA Checks	Local	critical
455124	SCA: security update for piscina (GHSA-67c8-pqhq-4rmx)	Tenable Self-Hosted Container Security	SCA Checks	Local	critical

Detections

Analytics

CVE-2026-102992

critical

Tenable Plugins

critical

critical

critical

critical