What is the CVSS score of CVE-2026-44966?

CVE-2026-44966 has a CVSS 3.1 base score of 8.3 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L. EPSS exploitation probability: 0.1%.

Which versions of Velocity.js are affected by CVE-2026-44966?

Velocity.js npm package versions 2.1.5 and earlier contain a prototype pollution vulnerability that allows unauthenticated remote attackers to manipulate core JavaScript objects through malicious…

How to fix or mitigate CVE-2026-44966?

Within 24 hours: Identify all applications and dependencies using Velocity.js <=2.1.5 via npm audit and Software Composition Analysis (SCA) tools; document affected systems and their exposure to untrusted template input. Within 7 days: Implement input validation and sandboxing controls (see compensating controls); restrict template processing to trusted sources only; test mitigations in non-production environments. Within 30 days: Monitor npm registry and vendor communications for patched versions; evaluate alternative template engines if patches remain unavailable; deploy validated fixes across production infrastructure.

Velocity.js CVE-2026-44966

HIGH

Improperly Controlled Modification of Object Prototype Attributes (Prototype Pollution) (CWE-1321)

2026-05-09 https://github.com/shepherdwind/velocity.js

GHSA-j658-c2gf-x6pq

Denial Of Service RCE Prototype Pollution

8.3

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

8.3 HIGH

AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Source Code Evidence Fetched

May 09, 2026 - 01:16 vuln.today

Analysis Generated

May 09, 2026 - 01:16 vuln.today

CVE Published

May 09, 2026 - 00:40 nvd

HIGH 8.3

DescriptionGitHub Advisory

Summary

A prototype pollution vulnerability was discovered in Velocity.js <= 2.1.5. This issue occurs during the processing of #set directives in Velocity templates. If an application renders a template controlled by an attacker, it is possible to modify Object.prototype, potentially leading to Denial of Service (DoS) or Remote Code Execution (RCE) depending on the server environment.

Details

The root cause is located in the #set path assignment logic within the source code:

File: /src/compile/set.ts
Issue: The engine accepts arbitrary path keys and performs assignments using the logic (baseRef as Record<string, unknown>)[key] = val.

Because there is no validation or filtering to block sensitive keys such as \_\_proto\_\_, constructor, or prototype, an attacker can traverse the prototype chain and pollute the global Object.prototype.

PoC

javascript

const {render} = require('velocityjs');
delete Object.prototype.polluted;
console.log({}.polluted); // ""
render('#set($__proto__.polluted = "hacked")', {});
console.log({}.polluted); // "hacked"
delete Object.prototype.polluted;

Impact

Vulnerability Type: Prototype Pollution
Who is impacted: Any application that renders Velocity templates where the template content can be influenced or controlled by untrusted users.
Severity: High. Prototype pollution can often be used to bypass security controls, cause application crashes (DoS), or be chained with other vulnerabilities to achieve code execution.

AnalysisAI

Prototype pollution in Velocity.js npm package versions <=2.1.5 allows remote attackers to modify Object.prototype through malicious #set directives in templates, enabling denial of service or potential remote code execution when template content is attacker-controlled. Publicly available exploit code exists. EPSS data unavailable, but the low attack complexity (CVSS AC:L), network attack vector (AV:N), and no authentication requirement (PR:N) combined with published POC code indicate elevated risk for applications rendering untrusted Velocity templates.

Technical ContextAI

Velocity.js is a JavaScript implementation of the Apache Velocity templating engine for Node.js applications. The vulnerability stems from improper input validation in the #set directive handler (src/compile/set.ts), which performs direct property assignments using JavaScript's bracket notation without filtering dangerous property names. The code executes (baseRef as Record<string, unknown>)[key] = val without blocking special keys like __proto__, constructor, or prototype. This is a classic CWE-1321 (Improperly Controlled Modification of Object Prototype Attributes) vulnerability. When user-controlled template strings are rendered, attackers can inject directives such as #set($__proto__.polluted = "value") to traverse the prototype chain and pollute Object.prototype, affecting all JavaScript objects in the runtime environment. The CPE identifier pkg:npm/velocityjs confirms this affects the npm package ecosystem.

RemediationAI

No vendor-released patch exists at time of analysis - the GitHub advisory explicitly lists 'fixed in: None' for versions <=2.1.5. Until a patched version is available, implement the following compensating controls with noted trade-offs: (1) Eliminate attacker control over template content - restrict template creation/modification to trusted administrators only and store templates server-side outside web root; this is the most effective mitigation but may break features requiring dynamic template generation. (2) Implement allowlist validation for #set directive variable names - modify or wrap the Velocity.js render function to reject templates containing __proto__, constructor, or prototype in #set statements; this requires code changes and may have false positives if legitimate variables use these names. (3) Deploy object-freeze protections - execute Object.freeze(Object.prototype) at application startup to prevent prototype modification; this can break libraries expecting mutable prototypes and should be tested thoroughly. (4) Sandbox template rendering - isolate Velocity.js execution in a separate V8 context using vm2 or isolated-vm npm packages; adds performance overhead and complexity. (5) Consider migrating to actively maintained alternatives like Handlebars, Mustache, or Nunjucks that have prototype pollution protections. Monitor https://github.com/shepherdwind/velocity.js/security/advisories/GHSA-j658-c2gf-x6pq for patch availability.