CVE-2026-15607: Tanstack DB Prototype Pollution Vulnerability

CVE-2026-15607 Overview

CVE-2026-15607 is a prototype pollution vulnerability affecting TanStack DB versions up to 0.6.8. The flaw resides in the select function within src/query/compiler/select.ts, part of the Alias Path Handler component. Attackers can manipulate alias path segments to modify object prototype attributes, enabling remote exploitation with low-privilege access. A public exploit is available, and the maintainers have released patch commit ac09b1177a100eafa85cba3cd09dd1f53f933ded to remediate the issue. The vulnerability is classified under CWE-94: Improper Control of Generation of Code and stems from insufficient validation of user-controlled property names in query alias paths.

Critical Impact

Remote attackers with low privileges can pollute JavaScript object prototypes through crafted .select() alias paths, potentially altering application logic across the runtime.

Affected Products

• TanStack DB versions up to and including 0.6.8
• The @tanstack/db package select() query compiler
• Applications embedding vulnerable versions of the TanStack DB library

Discovery Timeline

• 2026-07-13 - CVE-2026-15607 published to NVD
• 2026-07-15 - Last updated in NVD database

Technical Details for CVE-2026-15607

Vulnerability Analysis

The vulnerability exists in the query compiler of TanStack DB, a reactive client-side database library. When a developer invokes .select() with alias paths, the compiler in src/query/compiler/select.ts traverses the alias segments to build result objects. Because the compiler did not validate segment names against dangerous keys, an attacker could supply aliases containing __proto__, prototype, or constructor. Traversal into these keys writes to Object.prototype rather than the intended target object, contaminating every object in the JavaScript runtime. This is a classic prototype pollution primitive that can lead to logic corruption, denial of service, or authentication bypass depending on downstream consumers of polluted properties.

Root Cause

The root cause is missing allowlist validation on user-influenced alias path segments during query compilation. The compiler treats each segment as a legitimate property key and performs recursive assignment without filtering reserved prototype-related identifiers, satisfying the conditions of [CWE-94].

Attack Vector

Exploitation requires network-reachable access to an application that forwards untrusted input into TanStack DB .select() alias construction. The attacker crafts alias paths containing prototype-related segment names. No user interaction is required, and only low privileges are needed to trigger the compilation path.

// Patch: packages/db/src/errors.ts
// Introduces a new error class that rejects unsafe alias segments
export class UnsafeAliasPathError extends QueryCompilationError {
  constructor(segment: string) {
    super(
      `Unsafe alias path segment "${segment}" is not allowed in .select(). ` +
        `Aliases must not contain "__proto__", "prototype", or "constructor".`,
    )
    this.name = `UnsafeAliasPathError`
  }
}

Source: GitHub Commit ac09b11

// Patch: packages/db/src/query/compiler/select.ts
// Imports the new guard error used to block prototype-polluting aliases
import {
  AggregateNotSupportedError,
  UnsafeAliasPathError,
} from '../../errors.js'

Source: GitHub Commit ac09b11

Detection Methods for CVE-2026-15607

Indicators of Compromise

• Query payloads containing alias segments with the strings __proto__, prototype, or constructor
• Application-level QueryCompilationError exceptions originating from select.ts after patch deployment
• Unexpected properties appearing on baseline JavaScript objects during runtime inspection

Detection Strategies

• Inspect application logs and web request bodies for query parameters that include prototype-related keywords in select or alias fields
• Perform static analysis of application code to identify locations where untrusted input flows into TanStack DB .select() calls
• Enumerate installed @tanstack/db package versions across build manifests and lockfiles to identify versions <= 0.6.8

Monitoring Recommendations

• Add web application firewall rules that flag request payloads containing __proto__, prototype, or constructor in JSON keys
• Enable Node.js runtime warnings for prototype modification and forward them to centralized logging
• Track dependency inventories to detect reintroduction of vulnerable TanStack DB versions in future builds

How to Mitigate CVE-2026-15607

Immediate Actions Required

• Upgrade @tanstack/db to the patched release that includes commit ac09b1177a100eafa85cba3cd09dd1f53f933ded
• Audit application code for any surface where external input is passed into .select() alias parameters and add server-side validation
• Rebuild and redeploy applications after updating dependencies to ensure the patched compiler is bundled

Patch Information

The fix is delivered in commit ac09b1177a100eafa85cba3cd09dd1f53f933ded and merged via Pull Request #1595 addressing Issue #1584. The patch introduces an UnsafeAliasPathError that rejects alias path segments containing __proto__, prototype, or constructor before they reach the compilation logic.

Workarounds

• Reject or sanitize any client-supplied field that becomes part of a .select() alias, filtering the strings __proto__, prototype, and constructor
• Freeze Object.prototype at application startup using Object.freeze(Object.prototype) to prevent runtime mutation
• Restrict query construction to server-controlled, allowlisted schemas rather than accepting arbitrary alias paths from clients

# Update to the patched version of TanStack DB
npm install @tanstack/db@latest

# Verify the installed version is above 0.6.8
npm ls @tanstack/db

# Optional runtime hardening in application entry point
node -e "Object.freeze(Object.prototype); require('./server.js')"