Executive brief
@stablelib/cbor is a JavaScript library used to decode CBOR (Concise Binary Object Representation) data, a binary serialization format commonly used in IoT and messaging systems. An attacker can craft malicious CBOR payloads with special keys like "__proto__" that poison the prototype chain of decoded objects, allowing them to inject arbitrary properties that affect application behavior—such as bypassing authorization checks, altering configuration values, or corrupting feature flags.
Technical details
This is a prototype poisoning vulnerability (CWE-1321) in the CBOR decoder. The root cause is unsafe object property assignment: the decoder creates plain JavaScript objects and assigns attacker-controlled CBOR map keys directly using bracket notation (obj[key] = value), which for the special key "__proto__" does not create an own property but instead invokes the __proto__ setter, replacing the object's prototype. An attacker can send a CBOR payload with a map entry { "__proto__": { isAdmin: true } } over the network; no authentication or user interaction is required. The resulting decoded object will have an attacker-controlled prototype, causing any downstream code that reads properties via normal lookup to see injected values. The vulnerability is fixed in version 2.0.3 (and noted as 2.0.4 in one source).
Affected products
- StableLib @stablelib/cbor < 2.0.3
Timeline
- 2026-04-02: disclosed
- 2026-04-02: patched: Fixed in version 2.0.3