Casl Ability
Monthly
Denial of service in the @casl/ability npm package (6.7.5 through 7.0.1) stems from prototype pollution in the rulesToFields() helper, which expands attacker-influenced dotted condition keys through an internal setByPath utility and can overwrite inherited builtins such as Function.prototype.call, corrupting shared objects process-wide and crashing the Node.js process. Only applications that call rulesToFields() on rule conditions whose keys are under an attacker's write influence are affected, and the required access is authenticated (PR:L) with high attack complexity, so exposure is conditional rather than broad. The impact is availability only (no confidentiality or integrity loss), no public exploit code has been identified at time of analysis, and the flaw is not listed in CISA KEV, making this a moderate-severity issue rather than an urgent one.
Denial of service in the @casl/ability npm package (6.7.5 through 7.0.1) stems from prototype pollution in the rulesToFields() helper, which expands attacker-influenced dotted condition keys through an internal setByPath utility and can overwrite inherited builtins such as Function.prototype.call, corrupting shared objects process-wide and crashing the Node.js process. Only applications that call rulesToFields() on rule conditions whose keys are under an attacker's write influence are affected, and the required access is authenticated (PR:L) with high attack complexity, so exposure is conditional rather than broad. The impact is availability only (no confidentiality or integrity loss), no public exploit code has been identified at time of analysis, and the flaw is not listed in CISA KEV, making this a moderate-severity issue rather than an urgent one.