CVE-2026-26021: 
JavaScript vulnerability analysis and mitigation

CVE-2026-26021 is a prototype pollution vulnerability in the npm package set-in that allows attackers to corrupt Object.prototype via crafted input using Array.prototype manipulation. It affects set-in versions >= 2.0.1 and < 2.0.5, and was disclosed on February 11, 2026. The flaw is a bypass of a prior patch (related to CVE-2020-28273) that attempted to block prototype pollution by checking for forbidden keys using Array.prototype.includes(). It carries a CVSS v3.1 base score of 9.8 (Critical) and a CVSS v4.0 base score of 9.4 (Critical) (Github Advisory, set-in Advisory).

The root cause is classified as CWE-1321 (Improperly Controlled Modification of Object Prototype Attributes). The vulnerable code in index.js (line 28) used POLLUTED_KEYS.includes(key) to block forbidden path segments such as __proto__, constructor, and prototype. An attacker can bypass this check by overriding Array.prototype.includes to always return false before invoking set-in, allowing the path ['constructor', 'prototype', 'polluted'] to traverse and mutate Object.prototype. The fix in version 2.0.5 replaces the includes()-based check with strict equality comparisons (key == 'constructor' || key == 'prototype' || key == '__proto__'), which are not susceptible to prototype chain manipulation. A public proof-of-concept is included in the advisory (Github Advisory, Patch Commit).

Successful exploitation pollutes Object.prototype, affecting all objects in the JavaScript runtime of the vulnerable application. Depending on how downstream code uses the polluted properties, this can lead to authentication bypass, denial of service, or remote code execution — particularly if polluted properties flow into dangerous sinks such as eval() or child_process functions. Confidentiality, integrity, and availability are all rated High for both the vulnerable and subsequent systems, reflecting the broad blast radius of prototype pollution across an application's object graph (Github Advisory, set-in Advisory).

A working proof-of-concept is publicly documented in the GitHub Security Advisory and requires no authentication or special privileges to execute. There is no evidence of active in-the-wild exploitation or threat actor attribution at this time. The EPSS score is approximately 0.015% (0.039% per GitHub Advisory), indicating a currently low probability of exploitation in the next 30 days. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (Github Advisory, Feedly).

1. Identify target: Locate a Node.js application that uses set-in versions >= 2.0.1 and < 2.0.5 and processes attacker-controlled input passed to the set-in function.
2. Override Array.prototype.includes: In an execution context where the attacker can inject or influence JavaScript code (e.g., via a deserialization sink, server-side template, or shared runtime), override the built-in method: Array.prototype.includes = () => false;
3. Craft malicious path input: Construct a path array containing forbidden keys that would normally be blocked: ['constructor', 'prototype', 'polluted'].
4. Invoke set-in with the crafted path: Call the library with the malicious path and a chosen value: si(obj, ['constructor', 'prototype', 'polluted'], 'yes');
5. Confirm prototype pollution: Verify that Object.prototype has been modified by checking ({}).polluted === 'yes', confirming all objects in the runtime now inherit the injected property.
6. Leverage polluted property: Depending on the application, exploit the polluted property to achieve authentication bypass (e.g., if a property like isAdmin is checked on plain objects), trigger denial of service, or achieve RCE if the property flows into a dangerous sink such as eval() or child_process.exec() (Github Advisory, set-in Advisory).

• Logs: Unexpected JavaScript errors or stack traces referencing Object.prototype property access in application logs; anomalous behavior in authentication or authorization logic that references properties not explicitly set on objects.
• File System: Presence of set-in versions >= 2.0.1 and < 2.0.5 in node_modules/set-in/package.json ("version": "2.0.x" where x < 5); unpatched index.js containing POLLUTED_KEYS.includes(key) at line 28.
• Process: Unexpected spawning of child processes (e.g., sh, bash, node) from the application process if RCE is achieved via a polluted sink.
• Application Behavior: Sudden privilege escalation or authentication bypass for users who should not have elevated access; unexpected properties appearing on plain JavaScript objects during runtime inspection or debugging (Github Advisory).

Upgrade the set-in npm package to version 2.0.5 or later, which replaces the vulnerable Array.prototype.includes() check with strict equality comparisons immune to prototype chain manipulation. Run npm install set-in@2.0.5 or update the version constraint in package.json and run npm install. There is no known configuration-based workaround for affected versions; upgrading is the only reliable remediation (Github Advisory, Patch Commit).

The vulnerability was noted by security aggregators including The Hacker Wire on Mastodon and Bluesky shortly after disclosure. It was also picked up by vulnerability digest platforms such as tonyharris.io's PoC Week roundup for the week of February 23, 2026. No major vendor statements or significant researcher commentary beyond the advisory itself have been identified (Feedly).