Vulnerability in StableLib (CVE-2026-106448)
Summary
Vulnerability in StableLib (CVE-2026-106448). Risk of unauthorized operations or information disclosure.
Original description
The description as published by the source.
Summary
@stablelib/cbor decodes CBOR maps into ordinary JavaScript objects and assigns attacker-controlled keys directly onto those objects. A CBOR map key named __proto__ therefore changes the prototype of the decoded object instead of becoming an ordinary data property.
Details
The decoder builds map results with a plain {} and then stores attacker-controlled keys using bracket assignment.
That is unsafe for special property names. In JavaScript, assigning to obj["__proto__"] on a normal object does not create a plain own property. It invokes the built-in __proto__ setter and replaces the object’s prototype if the supplied value is an object or null.
As a result, a CBOR payload containing a map entry like:
- key:
"__proto__" - value:
{ isAdmin: true }
does not decode to an object with an own property called __proto__. It decodes to an object whose prototype is now attacker-controlled. Any code that later reads properties through normal lookup will see inherited attacker-supplied values.
PoC
import { decode } from "@stablelib/cbor";
// CBOR:
// {
// "__proto__": { "isAdmin": true }
// }
//
// a1 map(1)
// 69 text(9)
// "__proto__"
// a1 map(1)
// 67 text(7)
// "isAdmin"
// f5 true
const payload = new Uint8Array([
0xa1,
0x69, 0x5f, 0x5f, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x5f, 0x5f,
0xa1,
0x67, 0x69, 0x73, 0x41, 0x64, 0x…
Source: NIST National Vulnerability Database NVD GitHub Advisory
Auto-generated summary
Assembled by SecPulse from the source data (CVSS, CWE, affected versions) using templates — no AI involved. Check the original description and references below for exact details.
A vulnerability tracked as CVE-2026-106448 has been found in StableLib.
Risk of unauthorized operations or information disclosure.
What to do: apply the vendor's official patched release.
If unsure, ask your IT team or search "StableLib CVE-2026-106448" on the vendor's site.
CVE-2026-106448 (StableLib) — CWE-1321
Plan: 1) Audit SBOM/dependencies, 2) Stage→prod upgrade, 3) Add WAF/proxy monitoring on affected endpoints, 4) Hunt IOCs in logs.
Refs: see the GHSA / vendor advisory / patched release linked on this page.
A vulnerability (CWE-1321) exists in StableLib.
Check the vendor advisory for the affected versions of StableLib.
Severity: ?. Risk of unauthorized operations or information disclosure.
Update to the patched release per vendor advisory.
Until the patch is applied: disable the affected feature, apply WAF rules, or restrict access via network ACLs.
Search webserver/proxy logs for unusual request patterns matching this CVE's known IOCs. Run grep -r 'StableLib' . against your dependency files (package-lock.json, requirements.txt, go.sum) to find affected services.
Response actions
Concrete steps and command examples for SOC/SRE teams to execute in order
-
1Identify exposure identify
grep -r 'StableLib' . | grep -v node_modulesリポジトリと本番環境の依存ファイル (package-lock.json / requirements.txt / go.sum / Gemfile.lock 等) で
StableLibを grep し、稼働しているサービス・バージョンを把握する。 -
2Post-deployment verification verify
Confirm patched version is live in productionパッチ適用後、ステージングで PoC または同等の悪用パターンを再現して脆弱性が閉じたことを確認。本番ではアクセスログ・WAF でアラート再発が無いか継続監視。
Affected packages
References
- package github.com
- web github.com
- web security-advisories@github.com
- web github.com