Executive brief
MikroORM, a tool used by developers to manage database interactions in Node.js applications, contains a security flaw in how it handles data merging. An attacker could provide specially crafted input that modifies the fundamental behavior of the application's internal data structures. This can lead to application crashes, unpredictable behavior, or potentially allow unauthorized access to database information.
Technical details
A prototype pollution vulnerability (CWE-1321) exists in the Utils.merge helper function within MikroORM. The function fails to sanitize special JavaScript keys such as __proto__, constructor, or prototype during object merging operations. An attacker can exploit this by providing malicious input to application functions that utilize this helper, such as entity property assignment or query construction. Successful exploitation can result in global object prototype modification, leading to Denial of Service (DoS), logic bypasses, or SQL injection if the polluted properties influence database queries. The issue is fixed in versions 6.6.10 and 7.0.6.
Affected products
- mikro-orm MikroORM < 6.6.10, >= 7.0.0-rc.0 < 7.0.6
Timeline
- 2026-03-27: advisory: GitHub advisory GHSA-qpfv-44f3-qqx6 published
- 2026-03-31: disclosed: CVE-2026-34221 published to NVD