Which versions of Prototype Pollution are affected by CVE-2026-34221?

CVE-2026-34221 presents moderate security risk, a prototype pollution vulnerability. Exploitation could compromise the security of affected deployments.. A patch is available.

How to fix or mitigate CVE-2026-34221?

Within 7 days: Identify all affected systems and apply vendor patches promptly. Monitor vendor channels for patch availability.

Prototype Pollution CVE-2026-34221

Q: What is the CVSS score of CVE-2026-34221?

CVE-2026-34221 has a CVSS 4.0 base score of 8.3 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-17488 HIGH

Improperly Controlled Modification of Object Prototype Attributes (Prototype Pollution) (CWE-1321)

2026-03-29 https://github.com/mikro-orm/mikro-orm

GHSA-qpfv-44f3-qqx6

Prototype Pollution Denial Of Service SQLi

8.3

CVSS 4.0 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

8.3 HIGH

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Patch released

Mar 31, 2026 - 21:13 nvd

Patch available

EUVD ID Assigned

Mar 29, 2026 - 16:00 euvd

EUVD-2026-17488

Analysis Generated

Mar 29, 2026 - 16:00 vuln.today

CVE Published

Mar 29, 2026 - 15:44 nvd

HIGH 8.3

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

1 npm packages depend on @mikro-orm/core (1 direct, 0 indirect)

Ecosystem-wide dependent count for version 7.0.0-dev.0.

DescriptionGitHub Advisory

A prototype pollution vulnerability exists in the Utils.merge helper used internally by MikroORM when merging object structures.

The function did not prevent special keys such as __proto__, constructor, or prototype, allowing attacker-controlled input to modify the JavaScript object prototype when merged.

Exploitation requires application code to pass untrusted user input into ORM operations that merge object structures, such as entity property assignment or query condition construction.

Prototype pollution may lead to denial of service or unexpected application behavior. In certain scenarios, polluted properties may influence query construction and potentially result in SQL injection depending on application code.

AnalysisAI

Prototype pollution in MikroORM's Utils.merge function allows attackers to modify JavaScript object prototypes when applications pass untrusted user input into ORM operations. Affects @mikro-orm/core npm package, enabling denial of service and potentially SQL injection when polluted properties influence query construction. No public exploit identified at time of analysis, though GitHub security advisory published by the project maintainers confirms the vulnerability class (CWE-1321).

Technical ContextAI

MikroORM is a TypeScript ORM for Node.js supporting multiple SQL databases. The vulnerability resides in the internal Utils.merge helper function, which performs deep object merging for entity property assignment and query condition construction. The function lacks proper filtering of dangerous JavaScript special keys (__proto__, constructor, prototype), implementing the classic prototype pollution pattern (CWE-1321). When untrusted input flows through ORM operations like entity updates or query builders, attackers can inject these special keys to modify the base Object prototype chain. The affected package is pkg:npm/@mikro-orm_core, indicating the core ORM package distributed via npm. Prototype pollution in JavaScript allows modification of properties inherited by all objects in the runtime, creating a cross-cutting attack surface that transcends normal application boundaries.

RemediationAI

Consult the official GitHub security advisory at https://github.com/mikro-orm/mikro-orm/security/advisories/GHSA-qpfv-44f3-qqx6 for vendor-confirmed patch versions and upgrade guidance. Upstream fix available through the project's GitHub repository, though released patched version number not independently confirmed from provided data. Primary remediation requires upgrading @mikro-orm/core to the patched release specified in the advisory. As an immediate workaround, implement input validation and sanitization before passing user-controlled data to ORM operations, specifically filtering or rejecting objects containing __proto__, constructor, or prototype keys. Use Object.create(null) for user-input objects to prevent prototype chain inheritance, or employ libraries like lodash's merge with prototype pollution protections. Review application code for patterns that dynamically assign user input to entity properties or query conditions without schema validation. The GitHub advisory at https://github.com/advisories/GHSA-qpfv-44f3-qqx6 may contain additional mitigation guidance.