CVE-2026-16266: mongo-object Prototype Pollution Flaw

CVE-2026-16266 Overview

CVE-2026-16266 is a prototype pollution vulnerability affecting versions of the mongo-object npm package prior to 3.0.3. The flaw resides in the expandKey() function in util.js, where the package fails to sanitize property paths before assignment. An attacker can supply a crafted property path containing special keys such as __proto__, constructor, or prototype to modify the JavaScript prototype chain. Successful exploitation allows the attacker to inject or override properties on Object.prototype, which can cascade into logic bypasses, denial of service, or downstream code execution depending on how the host application consumes the polluted object.

Critical Impact
Attackers can modify the global JavaScript prototype chain through crafted input, affecting all objects in the Node.js runtime and enabling application logic manipulation.

Affected Products

mongo-object npm package versions prior to 3.0.3
Node.js applications importing vulnerable versions of mongo-object
Downstream packages that transitively depend on mongo-object

Discovery Timeline

2026-07-21 - CVE-2026-16266 published to NVD
2026-07-23 - Last updated in NVD database

Technical Details for CVE-2026-16266

Vulnerability Analysis

The vulnerability is classified under [CWE-1321] Improperly Controlled Modification of Object Prototype Attributes (Prototype Pollution). The expandKey() function in src/util.ts iterates over a dot-separated property path and assigns values to nested keys on a target object. Before the patch, the function performed no validation on the subkey names during traversal. When an attacker-controlled path contains __proto__, writes are applied to the prototype rather than the intended object. This pollutes shared object state across the entire Node.js process. The impact scope depends on the consuming application, but common downstream effects include authentication bypass, property injection into database queries, and denial of service.

Root Cause

The root cause is missing key sanitization inside the recursive key-expansion routine. The function trusted caller-supplied paths and used bracket-notation assignment without filtering reserved JavaScript property names. Because __proto__, constructor, and prototype traverse the prototype chain when used as object keys, an attacker who controls any portion of the path can pivot writes onto Object.prototype.

Attack Vector

Exploitation requires the attacker to supply a crafted key path to any code path that ultimately invokes expandKey(). This is typically reachable through HTTP request bodies, query parameters, or JSON payloads that get merged into MongoDB update documents. No authentication is required when the vulnerable code path is exposed to unauthenticated input.

typescript

// Security patch in src/util.ts
// fix: Fix prototype pollution vulnerability in expandKey (#33)
      subkey = subkey.slice(0, -1)
    }

+    // Prevent prototype pollution
+    if (subkey === '__proto__' || subkey === 'constructor' || subkey === 'prototype') {
+      return
+    }
+
    if (i === ln - 1) {
      // Last iteration; time to set the value; always overwrite
      current[subkey] = val

Source: GitHub Commit 6383141

Detection Methods for CVE-2026-16266

Indicators of Compromise

HTTP request bodies or query parameters containing the string __proto__, constructor.prototype, or prototype. within nested key paths.
Unexpected properties appearing on plain JavaScript objects that were not explicitly set by application code.
MongoDB update operations containing dot-notation keys with reserved JavaScript identifiers.

Detection Strategies

Perform a software composition analysis (SCA) scan of package-lock.json and yarn.lock files to identify direct and transitive dependencies on mongo-object below version 3.0.3.
Add runtime input validation middleware that rejects request payloads containing prototype-pollution key patterns before they reach ORM or ODM layers.
Enable Node.js --frozen-intrinsics flag in test environments to surface unintended prototype modifications during CI runs.

Monitoring Recommendations

Log and alert on inbound HTTP payloads containing __proto__, constructor, or prototype as object keys at the web application firewall (WAF) or reverse proxy layer.
Monitor Node.js application logs for TypeError exceptions related to unexpected object property access, which often accompany successful pollution.
Track dependency updates in the CI/CD pipeline to flag when mongo-object is present at vulnerable versions.

How to Mitigate CVE-2026-16266

Immediate Actions Required

Upgrade mongo-object to version 3.0.3 or later in all package.json files and lockfiles.
Audit transitive dependencies using npm ls mongo-object or yarn why mongo-object to identify indirect exposure.
Deploy input validation at API boundaries to reject payloads containing reserved prototype keys.

Patch Information

The fix is available in mongo-object version 3.0.3, delivered in commit 638314107d8b397e5453c28e41729522b3e8d67c. The patch adds an explicit check that returns early when subkey equals __proto__, constructor, or prototype. Details are available in the Snyk Vulnerability Report and the GitHub Issue Tracker.

Workarounds

If upgrading is not immediately feasible, wrap calls to affected functions with a pre-validation layer that rejects keys matching __proto__, constructor, or prototype.
Freeze Object.prototype at application startup using Object.freeze(Object.prototype) to prevent runtime modification.
Deploy WAF rules that inspect JSON bodies and drop requests containing prototype pollution signatures.

bash

# Upgrade the vulnerable package to the patched version
npm install mongo-object@^3.0.3

# Verify the installed version across the dependency tree
npm ls mongo-object

# Optional runtime hardening in application entrypoint
node -e "Object.freeze(Object.prototype); require('./server.js')"