CVE-2026-46681: ts-utils Privilege Escalation Vulnerability

CVE-2026-46681 Overview

CVE-2026-46681 is a prototype pollution vulnerability [CWE-1321] in @nevware21/ts-utils, a TypeScript/JavaScript utility library. The _copyProps function in lib/src/object/copy.ts iterates source object properties with for...in without an Object.hasOwnProperty check. It also fails to filter dangerous keys such as __proto__, constructor, and prototype. An attacker who controls a source object passed to a copy operation can pollute the prototype chain of every object in the application. Version 0.14.0 fixes the issue by adding safe key iteration helpers and hardened defaults.

Critical Impact
Attackers can pollute Object.prototype to alter application-wide behavior, bypass authorization checks, or achieve code execution through gadget chains in downstream code.

Affected Products

@nevware21/ts-utils versions prior to 0.14.0
Node.js and browser applications that pass untrusted input to the library's object copy utilities
Downstream TypeScript/JavaScript packages depending on vulnerable versions of @nevware21/ts-utils

Discovery Timeline

2026-07-21 - CVE-2026-46681 published to NVD
2026-07-23 - Last updated in NVD database

Technical Details for CVE-2026-46681

Vulnerability Analysis

The vulnerability sits in _copyProps inside lib/src/object/copy.ts. The function uses a for...in loop to enumerate properties on the source object. for...in walks both own and inherited enumerable string-keyed properties. Without an Object.prototype.hasOwnProperty.call(src, key) guard, inherited keys are copied to the target. The function additionally lacks a denylist for reserved keys __proto__, constructor, and prototype.

When an attacker supplies a JSON payload such as {"__proto__": {"isAdmin": true}} that flows into a copy operation, the assignment sets properties on Object.prototype. All objects in the running process then inherit the attacker-controlled property. Consequences include authorization bypass, denial of service, and, in some runtimes, remote code execution via known gadget chains in template engines or configuration parsers.

Root Cause

The root cause is missing input validation on property keys during object copy. The library treats every enumerable key as a legitimate data field. It does not distinguish between attacker-controlled reserved names and safe property names. This maps directly to [CWE-1321] Improperly Controlled Modification of Object Prototype Attributes.

Attack Vector

Exploitation requires the application to pass an attacker-influenced object into an API that internally calls _copyProps. Typical entry points include HTTP request bodies deserialized from JSON, query strings parsed into nested objects, and configuration merged from external sources. No authentication is required when the affected endpoint accepts unauthenticated input.

typescript

// Patch excerpt from lib/src/index.ts
// Adds objForEachKeySafe and forEachOwnKey/forEachOwnKeySafe exports
// and introduces the isUnsafePropKey helper used to filter reserved keys.
export { objForEachKey, objForEachKeySafe } from "./object/for_each_key";
export { forEachOwnKey, forEachOwnKeySafe } from "./object/forEachOwnKey";
export { isUnsafePropKey } from "./object/isUnsafePropKey";

Source: GitHub Commit 5e887f4

Detection Methods for CVE-2026-46681

Indicators of Compromise

Inbound HTTP requests containing JSON payloads with __proto__, constructor, or prototype keys.
Unexpected properties appearing on objects that were never explicitly assigned by application code.
Node.js processes exhibiting altered default behavior across unrelated modules after specific requests.
Runtime errors referencing prototype methods that were overwritten with non-callable values.

Detection Strategies

Perform a software composition analysis scan and flag any @nevware21/ts-utils version below 0.14.0 in package.json and package-lock.json.
Add a web application firewall rule that inspects request bodies for the literal strings __proto__, constructor.prototype, and prototype. in JSON contexts.
Enable Node.js runtime hooks or use Object.freeze(Object.prototype) in test builds to surface prototype writes during CI.

Monitoring Recommendations

Log and alert on deserialization errors and unexpected type coercions in application logs.
Monitor outbound requests from Node.js services for anomalies that may indicate gadget-based code execution.
Track dependency updates in build pipelines and fail builds that pin vulnerable versions of @nevware21/ts-utils.

How to Mitigate CVE-2026-46681

Immediate Actions Required

Upgrade @nevware21/ts-utils to version 0.14.0 or later in all production and development environments.
Audit application code for any direct or transitive use of the library's object copy utilities on untrusted input.
Reject HTTP request payloads containing keys __proto__, constructor, or prototype at the API gateway.

Patch Information

Version 0.14.0 resolves the vulnerability. The fix introduces isUnsafePropKey, objForEachKeySafe, and forEachOwnKey/forEachOwnKeySafe helpers, and hardens the default copy behavior against prototype pollution. See the GitHub Security Advisory GHSA-x7j8-49r8-mr43 and the remediation commit for full details.

Workarounds

Freeze Object.prototype early in application startup with Object.freeze(Object.prototype) to block writes.
Wrap calls to affected library functions with a sanitizer that removes __proto__, constructor, and prototype keys.
Validate all deserialized JSON against strict schemas using a library such as ajv before passing objects to copy utilities.

bash

# Upgrade the vulnerable package to the patched release
npm install @nevware21/ts-utils@^0.14.0

# Verify no vulnerable versions remain in the dependency tree
npm ls @nevware21/ts-utils

# Audit the full project for known advisories
npm audit --production