CVE-2026-27212: Swiperjs Swiper Auth Bypass Vulnerability

CVE-2026-27212 Overview

CVE-2026-27212 is a critical Prototype Pollution vulnerability affecting Swiper, a popular free and mobile touch slider library with hardware-accelerated transitions and native behavior. The vulnerability exists in the extend() utility function within shared/utils.mjs, where inadequate input validation allows attackers to pollute Object.prototype via crafted input using Array.prototype, bypassing previous security mitigations.

Critical Impact

This Prototype Pollution vulnerability can lead to Authentication Bypass, Denial of Service, and Remote Code Execution (RCE) in any application that processes attacker-controlled input using the affected Swiper package.

Affected Products

• swiperjs swiper versions 6.5.1 through 12.1.1
• Applications using Swiper on Node.js runtime
• Applications using Swiper on Bun runtime

Discovery Timeline

• 2026-02-21 - CVE-2026-27212 published to NVD
• 2026-02-24 - Last updated in NVD database

Technical Details for CVE-2026-27212

Vulnerability Analysis

The vulnerability resides in line 94 of shared/utils.mjs, specifically within the extend() utility function. A previous security fix attempted to mitigate prototype pollution by checking whether user input contained forbidden keys (__proto__, constructor, prototype) using the indexOf() function. However, this mitigation proved insufficient.

The flaw lies in how the indexOf() check was implemented. By crafting input that leverages Array.prototype instead of Object.prototype directly, attackers can bypass the string-based key filtering and successfully pollute the global Object.prototype. This bypass technique works across both Windows and Linux operating systems and affects applications running on Node.js and Bun runtimes.

Root Cause

The root cause is improper input validation in the extend() function. The original mitigation used noExtend.indexOf(key) < 0 to filter dangerous keys, but this array-based comparison could be bypassed through crafted payloads that exploit how JavaScript handles prototype chains with array methods. The fix replaces the array-based indexOf() check with direct string comparisons (key !== '__proto__' && key !== 'constructor' && key !== 'prototype'), which cannot be bypassed through prototype manipulation.

Attack Vector

This is a local attack vector vulnerability. An attacker must be able to supply malicious input that gets processed by the vulnerable extend() function. When user-controlled data flows into this function without proper sanitization, attackers can inject specially crafted objects that pollute the global Object.prototype. This pollution persists across the application, potentially affecting all objects and enabling:

• Authentication Bypass: By polluting authentication-related prototype properties
• Denial of Service: By corrupting critical object behaviors
• Remote Code Execution: In scenarios where polluted properties influence code execution paths

The following patch shows the security fix implemented in version 12.1.2:

 }
 function extend(...args) {
   const to = Object(args[0]);
-  const noExtend = ['__proto__', 'constructor', 'prototype'];
   for (let i = 1; i < args.length; i += 1) {
     const nextSource = args[i];
     if (nextSource !== undefined && nextSource !== null && !isNode(nextSource)) {
-      const keysArray = Object.keys(Object(nextSource)).filter((key) => noExtend.indexOf(key) < 0);
+      const keysArray = Object.keys(Object(nextSource)).filter(
+        (key) => key !== '__proto__' && key !== 'constructor' && key !== 'prototype',
+      );
       for (let nextIndex = 0, len = keysArray.length; nextIndex < len; nextIndex += 1) {
         const nextKey = keysArray[nextIndex];
         const desc = Object.getOwnPropertyDescriptor(nextSource, nextKey);

Source: GitHub Commit

The fix removes the array-based filtering approach and replaces it with explicit string equality checks, which eliminates the bypass vector through Array.prototype manipulation.

Detection Methods for CVE-2026-27212

Indicators of Compromise

• Unexpected properties appearing on Object.prototype in application runtime
• Authentication failures or bypasses correlating with unusual slider component inputs
• Application crashes or unexpected behavior in object property access
• Error logs showing prototype-related anomalies or type confusion errors

Detection Strategies

• Audit package.json and package-lock.json for Swiper versions between 6.5.1 and 12.1.1
• Implement runtime prototype pollution detection by monitoring Object.prototype for unexpected modifications
• Use Software Composition Analysis (SCA) tools to identify vulnerable Swiper dependencies
• Review application logs for patterns indicating exploitation attempts targeting the slider component

Monitoring Recommendations

• Monitor Node.js and Bun application logs for unusual object property access patterns
• Implement Object freeze/seal on critical prototypes where feasible to detect tampering attempts
• Set up dependency vulnerability scanning in CI/CD pipelines to catch vulnerable Swiper versions
• Enable runtime application self-protection (RASP) to detect prototype pollution attacks

How to Mitigate CVE-2026-27212

Immediate Actions Required

• Update Swiper to version 12.1.2 or later immediately
• Audit applications using Swiper versions 6.5.1 through 12.1.1 for potential exploitation
• Review application input validation to ensure user-controlled data is sanitized before reaching Swiper functions
• Consider implementing Object.freeze on critical prototypes as a defense-in-depth measure

Patch Information

The vulnerability has been fixed in Swiper version 12.1.2. The patch modifies the extend() function in src/shared/utils.mjs to use direct string comparisons instead of array-based indexOf() checks for filtering dangerous keys. This change eliminates the bypass vector through Array.prototype manipulation.

For detailed patch information, refer to the GitHub Commit and the GitHub Security Advisory GHSA-hmx5-qpq5-p643.

Workarounds

• If immediate upgrade is not possible, implement input validation to sanitize user-controlled data before it reaches Swiper's extend() function
• Consider using Object.freeze(Object.prototype) in controlled environments where prototype immutability won't break application functionality
• Implement a wrapper function that validates input objects before passing them to Swiper utilities
• Isolate Swiper operations in sandboxed environments where prototype pollution impact is limited

# Upgrade Swiper to patched version
npm update swiper@12.1.2

# Verify installed version
npm list swiper

# For yarn users
yarn upgrade swiper@12.1.2