CVE-2026-106448 StableLib CVE debrief

Who should care

Defenders responsible for TypeScript and JavaScript applications using StableLib should assess exposure and prioritize verification and remediation efforts. This includes reviewing the version of StableLib in use, upgrading to version 2.0.4 or later, and reviewing downstream code that trusts normal property lookup or merges the decoded object. Security teams and vulnerability management teams should also be aware of this vulnerability and its potential to

Why it matters

CVE-2026-106448 is a high-severity vulnerability in StableLib that allows for prototype poisoning via __proto__ map keys in CBOR decoding, potentially leading to security-sensitive decisions being made using inherited attacker data. Defenders should prioritize verifying the version of StableLib in use and upgrading to version 2.0.4 or later to mitigate this vulnerability.

• Security-sensitive decisions may be made using inherited attacker data
• Downstream code that trusts normal property lookup or merges the decoded object may be affected
• Verification of the version of StableLib in use is necessary
• Remediation requires upgrading to version 2.0.4 or later

Technical summary

The @stablelib/cbor CBOR map decoding path creates ordinary JavaScript objects and assigns attacker-controlled keys with bracket assignment. A map key named __proto__ invokes the inherited prototype setter instead of creating an ordinary own property, allowing the decoded object's prototype to contain attacker-controlled authorization or feature-flag values. This can lead to security-sensitive decisions being made using inherited attacker data. The vulnerability is fixed in version 2.0.4 of StableLib, which changes the decoding path to properly handle __proto__ map keys.

Defensive priority

Defenders should prioritize verifying the version of StableLib in use and upgrading to version 2.0.4 or later to mitigate this vulnerability.

Recommended defensive actions

• Verify the version of StableLib in use
• Upgrade to version 2.0.4 or later
• Review downstream code that trusts normal property lookup or merges the decoded object
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed

Evidence notes

The CVE record and source item provide details on the vulnerability, including its description, affected versions, and fixed version. The vulnerability is fixed in version 2.0.4 of StableLib. Defenders should verify the version of StableLib in use and review downstream code that trusts normal property lookup or merges the decoded object. The CVE record was published on 2026-10-06T19:45:02.616Z and has not been modified since then. There are no known ransomware campaigns using this vulnerability.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.