CVE-2026-44966: Velocity.js Prototype Pollution RCE Vulnerability

CVE-2026-44966 Overview

CVE-2026-44966 is a prototype pollution vulnerability in Velocity.js, a JavaScript implementation of the Apache Velocity template engine. The flaw exists in versions 2.1.5 and earlier and is triggered during the processing of #set directives in Velocity templates. When an application renders a template controlled by an attacker, the engine permits modification of Object.prototype. This can lead to Denial of Service (DoS) or Remote Code Execution (RCE) depending on the server environment. The weakness is classified under [CWE-1321] for improperly controlled modification of object prototype attributes.

Critical Impact
Attacker-controlled templates can pollute Object.prototype in Node.js applications, enabling DoS or RCE across the runtime.

Affected Products

Velocity.js versions 2.1.5 and earlier
Node.js applications embedding velocityjs for template rendering
Server-side rendering frameworks that pass untrusted input into Velocity templates

Discovery Timeline

2026-05-26 - CVE-2026-44966 published to NVD
2026-05-26 - Last updated in NVD database

Technical Details for CVE-2026-44966

Vulnerability Analysis

Velocity.js parses template directives such as #set to assign values to variables within the rendering context. The parser does not block access to special object keys, including __proto__, constructor, and prototype. An attacker who controls template content can write to these keys and modify Object.prototype. Properties added to the prototype propagate to every object in the JavaScript runtime. This affects subsequent code paths that read uninitialized properties, including security-relevant flags and configuration objects.

Protocol pollution attacks against Node.js libraries have repeatedly produced RCE chains when gadgets exist downstream, such as child_process argument handling or template rendering with default fields. Where no gadget is available, polluted prototypes still corrupt application state and cause crashes that result in DoS.

Root Cause

The root cause is the absence of key filtering during evaluation of #set assignments. The engine accepts arbitrary property paths and writes through them without distinguishing reserved prototype properties from regular data fields. This matches the [CWE-1321] pattern for improperly controlled modification of object prototype attributes.

Attack Vector

Exploitation requires the application to render a template whose contents are influenced by an attacker. The attack is remote, requires no authentication, and no user interaction. A single malicious #set directive targeting __proto__ or constructor.prototype is sufficient to mutate the global prototype chain. See the GitHub Security Advisory for technical details on the directive handling path.

Detection Methods for CVE-2026-44966

Indicators of Compromise

Velocity templates containing #set directives that reference __proto__, constructor, or prototype keys.
Unexpected properties appearing on objects created after template rendering, indicating prototype mutation.
Node.js process crashes or unexpected exceptions in code paths that read previously undefined properties.

Detection Strategies

Inspect application logs for template inputs containing the strings __proto__, constructor.prototype, or prototype. near #set tokens.
Run static analysis on stored templates and template sources to flag attacker-controllable inputs reaching velocityjs render calls.
Add runtime guards that detect modification of Object.prototype and emit telemetry to the security data lake.

Monitoring Recommendations

Capture HTTP request bodies and query parameters that feed template rendering endpoints for offline review.
Monitor Node.js processes for abnormal restarts, unhandled exceptions, and spawned child processes following template requests.
Correlate web application telemetry with endpoint process events to identify exploitation chains that reach RCE.

How to Mitigate CVE-2026-44966

Immediate Actions Required

Upgrade velocityjs to a version later than 2.1.5 once a patched release is published by the maintainer.
Treat all template content as untrusted and reject templates that contain __proto__, constructor, or prototype tokens.
Audit application code paths that pass user-controllable strings to Velocity.render or equivalent APIs.

Patch Information

Refer to the GitHub Security Advisory GHSA-j658-c2gf-x6pq for the official fix status and version guidance from the Velocity.js maintainers.

Workarounds

Pre-process templates to strip or reject directives that reference prototype keys before invoking the renderer.
Freeze Object.prototype at process startup using Object.freeze(Object.prototype) where application compatibility allows.
Run template rendering in an isolated worker or sandboxed process so that prototype pollution cannot affect the main application state.

bash

# Configuration example
# Freeze Object.prototype at Node.js startup to blunt prototype pollution
node --require ./harden-prototype.js app.js

# harden-prototype.js contents:
#   Object.freeze(Object.prototype);
#   Object.freeze(Array.prototype);
#   Object.freeze(Function.prototype);