CVE-2026-34221: 
JavaScript vulnerability analysis and mitigation

CVE-2026-34221 is a prototype pollution vulnerability in the Utils.merge helper function used internally by MikroORM, a TypeScript ORM for Node.js. The flaw allows attacker-controlled input to modify the JavaScript object prototype by passing special keys such as __proto__, constructor, or prototype during object merging operations. It affects @mikro-orm/core versions prior to 6.6.10 and versions 7.0.0 through 7.0.5. The advisory was published on March 27, 2026, by maintainer B4nan, and assigned a CVSS v3.1 base score of 9.1 (Critical) and a CVSS v4.0 base score of 8.3 (High) (GitHub Advisory, MikroORM Advisory).

The root cause is classified as CWE-1321 (Improperly Controlled Modification of Object Prototype Attributes — 'Prototype Pollution'). The Utils.merge function, used internally for merging object structures such as entity property assignments and query condition construction, failed to block or sanitize reserved JavaScript prototype keys (__proto__, constructor, prototype). An unauthenticated remote attacker can exploit this by supplying a crafted JSON payload containing these special keys through any application endpoint that passes user input into MikroORM ORM operations (e.g., entity creation, query filters). The key precondition is that the application must directly or indirectly pass untrusted user-controlled data into ORM merge operations without prior sanitization (GitHub Advisory, MikroORM Advisory).

Successful exploitation can lead to denial of service by corrupting shared JavaScript object prototypes, causing unexpected application behavior across all objects inheriting from the polluted prototype. In certain application code patterns, polluted prototype properties may influence query construction in MikroORM, potentially resulting in SQL injection — impacting data integrity and potentially exposing or corrupting database contents. The CVSS v3.1 scoring reflects high integrity and availability impact with no direct confidentiality impact, though SQL injection scenarios could indirectly expose sensitive data (GitHub Advisory, MikroORM Advisory).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the time of publication (GitHub Advisory). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.045–0.048%, placing it in the 15th percentile for exploitation probability within 30 days. No threat actor attribution has been reported. The vulnerability was discovered and reported by researcher lukas-eu (MikroORM Advisory).

1. Reconnaissance: Identify Node.js applications using @mikro-orm/core versions below 6.6.10 or between 7.0.0 and 7.0.5 by inspecting publicly accessible package.json files, npm lock files, or error messages that reveal ORM version information.
2. Identify injection point: Locate application endpoints that accept JSON input and pass it directly or indirectly to MikroORM operations such as entity creation (em.create()), property assignment, or query condition construction (e.g., em.find() with user-supplied filters).
3. Craft malicious payload: Construct a JSON payload containing prototype pollution keys, for example:

{
  "__proto__": { "polluted": true },
  "constructor": { "prototype": { "isAdmin": true } }
}

4. Submit payload: Send the crafted payload via HTTP POST (or other applicable method) to the vulnerable endpoint, causing Utils.merge to process the special keys and modify Object.prototype globally within the Node.js process.
5. Achieve objective: Depending on application logic, the polluted prototype may cause denial of service (application crashes or unexpected behavior), bypass authorization checks relying on prototype-inherited properties, or influence ORM query construction to achieve SQL injection (GitHub Advisory, MikroORM Advisory).

• Network: Unusual HTTP requests containing JSON bodies with keys __proto__, constructor, or prototype to API endpoints backed by MikroORM; unexpected spikes in application errors or crashes following such requests.
• Logs: Application error logs showing unexpected property access on Object.prototype; Node.js unhandled exception logs referencing MikroORM Utils.merge or ORM query construction failures; access logs showing repeated POST requests with anomalous JSON payloads.
• Application Behavior: Sudden changes in application-wide object behavior (e.g., all objects unexpectedly inheriting new properties); authorization bypasses where users gain elevated privileges without explicit assignment; malformed or unexpected SQL queries logged by the database layer.
• File System: No specific file artifacts expected, but review for unexpected changes to ORM configuration files or entity definitions that could indicate post-exploitation tampering.

Upgrade @mikro-orm/core to version 6.6.10 (for the v6 branch) or 7.0.6 (for the v7 branch), which patch the Utils.merge function to block special prototype keys (MikroORM Advisory, GitHub Advisory). As a workaround prior to patching, implement strict input validation and sanitization to strip or reject keys such as __proto__, constructor, and prototype from any user-controlled data before it reaches ORM operations. Review application code to identify all locations where untrusted input is passed to entity property assignment or query condition construction, and apply allowlist-based validation at those boundaries.

The vulnerability was reported by researcher lukas-eu and published by MikroORM maintainer B4nan on March 27, 2026, with patches released simultaneously (MikroORM Advisory). Red Hat acknowledged the CVE on April 1, 2026. No significant broader media coverage or notable public researcher commentary beyond the advisory itself has been identified at this time.