CVE-2026-16150: Inputmask Prototype Pollution Vulnerability

CVE-2026-16150 Overview

CVE-2026-16150 is a prototype pollution vulnerability in the RobinHerbots Inputmask JavaScript library through version 5.0.9. The flaw resides in the extendDefaults, extendDefinitions, and extendAliases functions inside lib/dependencyLibs/extend.js, which implements an internal deep merge helper. Attackers can supply crafted objects that traverse into __proto__ and modify Object.prototype attributes across the running JavaScript context. The vulnerability is remotely exploitable and maps to CWE-94: Improper Control of Generation of Code. The project maintainers were notified through an issue report but had not responded at time of disclosure.

Critical Impact
Remote attackers can pollute JavaScript object prototypes in applications embedding Inputmask 5.0.9 or earlier, enabling downstream property injection, logic tampering, and potential code execution depending on the host application context.

Affected Products

RobinHerbots Inputmask versions up to and including 5.0.9
Web applications bundling the vulnerable lib/dependencyLibs/extend.js helper
Front-end frameworks and forms depending on the affected deep merge routines

Discovery Timeline

2026-07-18 - CVE-2026-16150 published to the National Vulnerability Database
2026-07-20 - Last updated in NVD database

Technical Details for CVE-2026-16150

Vulnerability Analysis

Inputmask is a widely deployed JavaScript library that applies input formatting masks to HTML form fields. The library exposes three configuration extension entry points: extendDefaults, extendDefinitions, and extendAliases. Each of these calls into a shared deep merge helper defined in lib/dependencyLibs/extend.js. The helper recursively copies properties from a source object into a destination object without filtering dangerous keys such as __proto__, constructor, or prototype.

When an attacker controls any portion of the input passed to these functions, they can inject a nested object that walks the prototype chain during the recursive merge. This mutates Object.prototype, causing every subsequent object in the runtime to inherit attacker-controlled properties. Downstream effects vary by application but commonly include authentication bypass, denial of service, and, in Node.js contexts, code execution through gadgets such as template engines or child process configuration.

Root Cause

The root cause is unsafe recursive property assignment in the deep merge helper. The function does not validate keys against a denylist and does not use Object.create(null) or Object.hasOwn guards before assignment. Any request path that funnels untrusted JSON into extendDefaults, extendDefinitions, or extendAliases becomes a prototype pollution sink.

Attack Vector

Exploitation requires the attacker to influence configuration input that reaches the affected extension functions. Common vectors include client-side code that deserializes URL parameters or postMessage data into mask options, and server-side rendering pipelines that merge user JSON into Inputmask settings. A payload of the form {"__proto__": {"polluted": "value"}} passed to any affected function results in ({}).polluted === "value" for the remainder of the process lifetime.

No public proof-of-concept exploit or exploit database entry has been published. Refer to the GitHub Issue #2885 and the VulDB CVE-2026-16150 entry for the coordinated technical details.

Detection Methods for CVE-2026-16150

Indicators of Compromise

HTTP request bodies or query strings containing the literal strings __proto__, constructor.prototype, or prototype[ targeting form endpoints
Unexpected properties appearing on baseline objects during application runtime, such as new keys on empty object literals
JavaScript runtime errors referencing properties that were never explicitly assigned in application code

Detection Strategies

Perform a software composition analysis scan across web repositories and CI artifacts to inventory every instance of inputmask at or below version 5.0.9
Deploy web application firewall or reverse proxy rules that inspect request payloads for prototype pollution key patterns and reject them at the edge
Add runtime assertions in staging environments that freeze Object.prototype with Object.freeze(Object.prototype) to surface pollution attempts during test runs

Monitoring Recommendations

Alert on outbound traffic from Node.js services that follows unusual patterns after form submissions, which can indicate gadget-chain execution
Track version drift of front-end dependencies in production bundles using integrity checks and content security policy reports
Correlate form submission telemetry with subsequent authentication anomalies to identify pollution-driven authorization bypass

How to Mitigate CVE-2026-16150

Immediate Actions Required

Identify all applications shipping Inputmask 5.0.9 or earlier and treat them as vulnerable until patched or removed
Filter or reject any user-controlled input containing the keys __proto__, constructor, and prototype before it reaches Inputmask configuration functions
Freeze Object.prototype at application startup in Node.js services that embed Inputmask on the server side

Patch Information

At the time of publication, the RobinHerbots Inputmask project had not released a fixed version and had not responded to the disclosure report. Monitor the Inputmask GitHub repository and Issue #2885 for an official patch. Once available, upgrade to the fixed release across all bundles.

Workarounds

Wrap calls to extendDefaults, extendDefinitions, and extendAliases with a sanitizer that strips dangerous keys from the input object before invocation
Replace the vulnerable deep merge helper with a hardened implementation such as lodash.mergeWith configured to skip prototype keys, or Object.assign with pre-validated flat objects
Restrict Inputmask configuration to build-time static values and disallow runtime configuration derived from untrusted sources

bash

# Configuration example: audit and pin Inputmask across a repository
npm ls inputmask
npm why inputmask
# After a fixed version is released, enforce the minimum
npm install inputmask@latest --save-exact
# Add a resolutions override in package.json for transitive dependencies
# "overrides": { "inputmask": ">=5.0.10" }