CVE-2026-111172 stalniy CVE debrief

Who should care

Defenders responsible for Node.js applications using the @casl/ability library should assess exposure and prioritize upgrading to version 7.0.2 or later. Defenders should also review inherited builtins to prevent exploitation and monitor the Node.js process for potential denial of service. Affected operators, platforms, and security teams should take immediate action to remediate this vulnerability.

Why it matters

Defenders should care about CVE-2026-111172 because it allows attackers to potentially cause denial of service for the Node.js process by modifying inherited builtins. Node.js applications using @casl/ability versions 6.7.5 before 7.0.2 are affected. Defenders should prioritize upgrading to version 7.0.2 or later and monitor the Node.js process for potential exploitation.

• Denial of service for the Node.js process
• Potential modification of inherited builtins
• Required verification of affected versions and remediation
• Need for monitoring Node.js process for potential exploitation

Technical summary

The @casl/ability library versions 6.7.5 before 7.0.2 contains a prototype pollution vulnerability in the rulesToFields() function. This allows attackers to modify inherited builtins via dotted condition keys, potentially causing denial of service for the Node.js process. The vulnerability is caused by a flaw in the rulesToFields() function, which allows attackers to supply keys like 'toString.call' to alter shared builtin functions process-wide. Defenders should prioritize upgrading to version 7.0.2 or later to mitigate this vulnerability.

Defensive priority

Defenders should prioritize upgrading to version 7.0.2 or later to mitigate this vulnerability.

Recommended defensive actions

• Upgrade to version 7.0.2 or later
• Review and modify inherited builtins to prevent exploitation
• Monitor Node.js process for potential denial of service
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The vulnerability is caused by a flaw in the rulesToFields() function, which allows attackers to supply keys like 'toString.call' to alter shared builtin functions process-wide. Evidence is limited to the supplied source corpus and CVE record. Defenders should verify affected versions and review inherited builtins to prevent exploitation. The rulesToFields() function does not properly sanitize input, allowing attackers to inject malicious keys.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.