CVE-2026-111172

@casl/ability 6.7.5 before 7.0.2 contains a prototype pollution vulnerability in rulesToFields() that allows attackers to modify inherited builtins via dotted condition keys. Attackers controlling rule conditions can supply keys like 'toString.call' to alter shared builtin functions process-wide, causing denial of service for the Node.js process.

CVSS 4.0

6.0CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

CVSS 3.1

5.3CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H

EPSS

0.4% chance of exploitation in the next 30 days; higher than 32% of CVEs (scores of 2026-10-25)

CWE

CWE-1321

Published

2026-10-15

Modified

2026-10-16

Record from

the NVD, synced 2026-10-19

References

• https://github.com/stalniy/casl
• https://github.com/stalniy/casl/blob/80f2380d03cfe9b162685d510ba8bc0ce83d0598/packages/casl-ability/src/utils.ts#L11-L29
• https://github.com/stalniy/casl/commit/58242cb3c7911c8a89bacfb7d732701d81bc1324
• https://github.com/stalniy/casl/pull/1305
• https://www.vulncheck.com/advisories/casl-ability-6.7.5-before-7.0.2-prototype-pollution-via-rulestofields-setbypath

Check your stackJSON