CVE-2026-1774: 
JavaScript vulnerability analysis and mitigation

CVE-2026-1774 is a prototype pollution vulnerability in the @casl/ability npm package, a widely used JavaScript library for attribute-based access control. It affects versions 2.4.0 through 6.7.4 and was publicly disclosed on February 10, 2026. The vulnerability was discovered by Maor Caplan from Alma Security and coordinated through CERT/CC. It carries a CVSS v3.1 base score of 9.8 (Critical), requiring no privileges or user interaction and exploitable over the network (GitHub Advisory, CERT/CC).

The vulnerability is classified as CWE-1321 (Improperly Controlled Modification of Object Prototype Attributes) and originates in the setByPath() function within the rulesToFields() method of the CASL extra module (CERT/CC). The setByPath() function fails to sanitize path segments before using them as object property keys, allowing special property names such as __proto__, prototype, and constructor to be passed as valid keys. An attacker who can influence the rule conditions or field paths processed by CASL can craft a payload that traverses the prototype chain and writes arbitrary properties to Object.prototype, the root prototype inherited by all JavaScript objects in the Node.js process (GitHub Advisory, MDN). The fix is available in commit 39da920 of the stalniy/casl repository, tracked under GitHub issue #1093.

Successful exploitation allows an attacker to inject arbitrary properties into Object.prototype, affecting all JavaScript objects in the running Node.js process. This can lead to authorization bypass (e.g., setting isAdmin: true on all objects), arbitrary code execution, logic manipulation, and denial of service through type mismatches that cause application crashes (CERT/CC). Because CASL is a library used across multiple applications and services, a single exploit can have a cascading effect, potentially compromising multiple systems and enabling unauthorized access to sensitive resources with high impact on confidentiality, integrity, and availability (GitHub Advisory).

As of the time of disclosure, there is no public proof-of-concept exploit and no evidence of in-the-wild exploitation (Feedly). The EPSS score is approximately 0.022–0.025%, placing it in the 7th percentile for near-term exploitation likelihood (GitHub Advisory). The vulnerability is not currently listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been reported. The vulnerability is detectable by Qualys scanner (detection ID: 5007589) (Feedly).

1. Identify target: Locate a Node.js application using @casl/ability versions 2.4.0–6.7.4 that processes user-controlled input through CASL rule conditions or field paths (e.g., via an API endpoint that accepts rule definitions or field selectors).
2. Craft prototype pollution payload: Construct a malicious input that passes a path segment containing __proto__, constructor.prototype, or prototype to the rulesToFields() / setByPath() function. For example, a field path like __proto__.isAdmin or constructor.prototype.isAdmin.
3. Submit payload: Send the crafted payload to the application through any input vector that reaches the vulnerable setByPath() function — such as an API request body, query parameter, or configuration input that CASL processes.
4. Trigger prototype pollution: The unsanitized path segment causes setByPath() to write the attacker-controlled value (e.g., true) to Object.prototype.isAdmin, affecting all objects in the Node.js process.
5. Achieve objective: Exploit the polluted prototype to bypass authorization checks (e.g., gaining admin access), manipulate application logic, execute arbitrary code if a gadget chain exists, or cause a denial of service by injecting type-incompatible values (CERT/CC, MDN).

• Logs: Unexpected authorization escalations or access control bypasses in application logs; errors related to unexpected property types on objects (e.g., TypeError involving prototype-inherited properties).
• Application Behavior: Non-admin users gaining admin-level access; application logic behaving unexpectedly as if certain flags (e.g., isAdmin, enabled) are set globally across all objects.
• Network: Unusual API requests containing path segments with __proto__, constructor, or prototype keywords in field names or rule condition parameters sent to endpoints that invoke CASL's rulesToFields() function.
• Process: Node.js process exhibiting unexpected behavior such as crashes due to type mismatches on prototype-inherited properties, or outbound connections initiated unexpectedly if a code execution gadget chain is triggered (CERT/CC, MDN).

Users should upgrade @casl/ability to version 6.7.5 or later, which patches the setByPath() function to properly sanitize path segments and reject special prototype-related keys (CERT/CC, GitHub Advisory). As a temporary workaround prior to patching, operators can freeze Object.prototype using Object.freeze(Object.prototype) to prevent modifications, or use the Node.js --disable-proto=delete flag to remove the __proto__ accessor (MDN). Additionally, validate and sanitize all user-controlled inputs that reach CASL rule processing, rejecting keys matching __proto__, constructor, or prototype.

CERT/CC published Vulnerability Note VU#458422 on February 10, 2026, crediting Maor Caplan from Alma Security for coordinating the responsible disclosure (CERT/CC). The vulnerability was covered in The Hacker News' weekly security recap alongside other notable vulnerabilities disclosed that week (The Hacker News). Red Hat also acknowledged the CVE in their security tracking (Red Hat).