Changes.Watch~ upgrade verdicts ~
Free digest
CriticalPHP2Shell: is your PHP patched?

critical vulnerability

piscina: Prototype-pollution gadget in ThreadPool.options allows RCE via execArgv / loadBalancer / env

Fix availableCritical · CVSS 9.2EPSS 0.43%

Published Oct 1, 2026 · updated Oct 1, 2026

What to do

  1. Upgrade to a fixed version: piscina 5.3.2, piscina 4.9.4, piscina 6.0.0-rc.5.
  2. Redeploy and restart long-running processes so they load the fixed code.

Affected packages

npmpiscina6,676,619 downloads/week

Vulnerable versions
>= 5.0.0, < 5.3.2
Fixed in
5.3.2

Check your project: npm ls piscina --all

Is piscina@5.3.2 safe to install? See the upgrade verdict →

npmpiscina6,676,619 downloads/week

Vulnerable versions
< 4.9.4
Fixed in
4.9.4

Check your project: npm ls piscina --all

Is piscina@4.9.4 safe to install? See the upgrade verdict →

npmpiscina6,676,619 downloads/week

Vulnerable versions
>= 6.0.0-rc.1, < 6.0.0-rc.5
Fixed in
6.0.0-rc.5

Check your project: npm ls piscina --all

Is piscina@6.0.0-rc.5 safe to install? See the upgrade verdict →

Sources

CWE-1321 Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')

← All critical vulnerabilities