Skip to main content

CISA issues alert on CASL Ability prototype pollution in 2.4.0–6.7.4

Source Decision Insights Threat Desk Published February 10, 2026 Companies 2
Human View Machine View

2 companies named across 2 categories, one of 9 articles referencing Node.js. Previous coverage: IBM Lightpath Digital Realty report infrastructure updates - Week of January 26, 2026 (Jan 2026).

Companies mentioned

Best suited for

Seniority
Staff
Job function
Cybersecurity / Information Security
Persona
Security Operations Practitioner
Buyer role
Technical Implementer / Administrator
Decision stage
Which to buy
Adoption curve
Late Majority
Industry
Information Technology / Software & Services / IT Services / Internet Services & Infrastructure

Our classification, not the publisher's statement. Best suited for, not only for.

CASL Ability versions 2.4.0 through 6.7.4 contain a prototype pollution vulnerability in the extra module's rulesToFields() function that can permit injection or modification of properties on Object.prototype within a Node.js process.

CVE-2026-1774 is associated with this issue and affects CASL Ability 2.4.0 through 6.7.4. The vulnerability stems from the extra module where rulesToFields() uses a helper called setByPath(). setByPath() fails to sanitize path segments before using them as property keys and accepts special names such as prototype and constructor. The _proto_ property can be used to traverse the prototype chain and write to Object.prototype, the root prototype of all objects.

Because Object.prototype is the root prototype that all JavaScript objects inherit from, changes to its properties can allow an attacker to execute arbitrary code and potentially lead to a complete system compromise. An attacker can bypass intended authorization logic, allowing unauthorized access to sensitive resources. Polluting Object.prototype can cause unintended behavior in application code, enable logic manipulation that permits actions normally restricted, and can cause crashes or unexpected behavior if polluted properties do not match expected types, leading to Denial of Service (DoS). The vulnerability exists in the CASL library used by multiple applications and services, so a single exploit can have a ripple effect, compromising multiple systems and potentially leading to a widespread security breach.

Users of the library should upgrade to version 6.7.5 or later, available at https://github.com/stalniy/casl/tree/master/packages/casl-ability.

References included in the advisory are the project repository, the CWE entry at https://cwe.mitre.org/data/definitions/1321.html, and the MDN page on prototype pollution at https://developer.mozilla.org/en-US/docs/Web/Security/Attacks/Prototype_pollution; the advisory also lists CVE-2026-1774 with a public date of 2026-02-10 and a last updated timestamp of 2026-02-10 15:14 UTC.

Blog post, originally published by Ayushi Kriplani; Dr. E. Drennan, CISSP at kb.cert.org.

Mentions

Structured data (JSON-LD)

The schema.org markup this page publishes for search engines and AI agents, exactly as they read it.

[
  {
    "@context": "https://schema.org",
    "@id": "https://decisioninsights.ai/#website",
    "@type": "WebSite",
    "name": "Decision Insights",
    "potentialAction": {
      "@type": "SearchAction",
      "target": {
        "@type": "EntryPoint",
        "urlTemplate": "https://decisioninsights.ai/search/?q={search_term_string}&submit=1"
      }
    },
    "publisher": {
      "@id": "https://decisioninsights.ai/#organization"
    },
    "url": "https://decisioninsights.ai"
  },
  {
    "@context": "https://schema.org",
    "@id": "https://decisioninsights.ai/#organization",
    "@type": "Organization",
    "contactPoint": {
      "@type": "ContactPoint",
      "contactType": "customer support",
      "email": "[email protected]"
    },
    "description": "Decision Insights is a Registry of technology companies, open source projects, and industry terms, built for people and for AI agents that need sourced, structured information.",
    "logo": {
      "@type": "ImageObject",
      "url": "https://wiretap-cdn-assets.nyc3.cdn.digitaloceanspaces.com/decision-insights/[email protected]"
    },
    "name": "Decision Insights",
    "parentOrganization": {
      "@type": "Organization",
      "name": "Wiretap Labs",
      "sameAs": [
        "https://www.linkedin.com/company/wiretap-labs",
        "https://www.crunchbase.com/organization/wiretap-labs"
      ],
      "url": "https://wiretaplabs.com"
    },
    "publishingPrinciples": "https://decisioninsights.ai/standards/",
    "sameAs": [
      "https://www.linkedin.com/company/decisioninsights"
    ],
    "url": "https://decisioninsights.ai"
  },
  {
    "@context": "https://schema.org",
    "@type": "BreadcrumbList",
    "itemListElement": [
      {
        "@type": "ListItem",
        "item": "https://decisioninsights.ai",
        "name": "Decision Insights",
        "position": 1
      },
      {
        "@type": "ListItem",
        "item": "https://decisioninsights.ai/records/",
        "name": "Records",
        "position": 2
      },
      {
        "@type": "ListItem",
        "item": "https://decisioninsights.ai/cisa-issues-alert-on-casl-ability-prototype-pollution-in-2-4-0-6-7-4/",
        "name": "CISA issues alert on CASL Ability prototype pollution in 2.4.0–6.7.4",
        "position": 3
      }
    ]
  },
  {
    "@context": "https://schema.org",
    "@id": "https://decisioninsights.ai/cisa-issues-alert-on-casl-ability-prototype-pollution-in-2-4-0-6-7-4/#blogposting",
    "@type": "BlogPosting",
    "about": {
      "@id": "https://decisioninsights.ai/registry/the-node-foundation/#organization",
      "@type": "Organization",
      "mainEntityOfPage": "https://decisioninsights.ai/registry/the-node-foundation/",
      "name": "Node.js"
    },
    "audience": [
      {
        "@type": "Audience",
        "additionalType": "Seniority",
        "audienceType": "Staff"
      },
      {
        "@type": "Audience",
        "additionalType": "Job function",
        "audienceType": "Cybersecurity / Information Security"
      },
      {
        "@type": "Audience",
        "additionalType": "Persona",
        "audienceType": "Security Operations Practitioner"
      },
      {
        "@type": "Audience",
        "additionalType": "Buyer role",
        "audienceType": "Technical Implementer / Administrator"
      },
      {
        "@type": "Audience",
        "additionalType": "Adoption curve",
        "audienceType": "Late Majority"
      },
      {
        "@type": "Audience",
        "additionalType": "Industry",
        "audienceType": "Information Technology / Software & Services / IT Services / Internet Services & Infrastructure"
      }
    ],
    "author": {
      "@id": "https://decisioninsights.ai/author/decision-insights-threat-desk/#person",
      "@type": "Person",
      "name": "Decision Insights Threat Desk",
      "url": "https://decisioninsights.ai/author/decision-insights-threat-desk/"
    },
    "dateModified": "2026-08-23T13:04:58-06:00",
    "datePublished": "2026-02-10T10:57:44-07:00",
    "description": "CASL prototype pollution: CASL Ability 2.4.0–6.7.4 allows Object.prototype modification; upgrade to 6.7.5 or later.",
    "headline": "CISA issues alert on CASL Ability prototype pollution in 2.4.0–6.7.4",
    "isBasedOn": {
      "@type": "CreativeWork",
      "author": {
        "@type": "Person",
        "name": "Ayushi Kriplani; Dr. E. Drennan, CISSP"
      },
      "sourceOrganization": {
        "@id": "https://decisioninsights.ai/registry/department-of-homeland-security/#organization",
        "@type": "Organization",
        "mainEntityOfPage": "https://decisioninsights.ai/registry/department-of-homeland-security/",
        "name": "Department of Homeland Security"
      },
      "url": "https://kb.cert.org/vuls/id/458422"
    },
    "keywords": [
      "Denial of Service",
      "Vulnerabilities"
    ],
    "mainEntityOfPage": {
      "@id": "https://decisioninsights.ai/cisa-issues-alert-on-casl-ability-prototype-pollution-in-2-4-0-6-7-4/",
      "@type": "WebPage",
      "sdDatePublished": "2026-08-23",
      "sdPublisher": {
        "@id": "https://decisioninsights.ai/#organization"
      }
    },
    "mentions": [
      {
        "@id": "https://decisioninsights.ai/registry/department-of-homeland-security/cybersecurity-and-infrastructure-security-agency-cisa/#organization",
        "@type": "Organization",
        "mainEntityOfPage": "https://decisioninsights.ai/registry/department-of-homeland-security/cybersecurity-and-infrastructure-security-agency-cisa/",
        "name": "Cybersecurity and Infrastructure Security Agency (CISA)"
      },
      {
        "@id": "https://decisioninsights.ai/registry/the-node-foundation/#organization",
        "@type": "Organization",
        "mainEntityOfPage": "https://decisioninsights.ai/registry/the-node-foundation/",
        "name": "Node.js"
      },
      {
        "@type": "SoftwareSourceCode",
        "name": "Node.js"
      }
    ],
    "publisher": {
      "@id": "https://decisioninsights.ai/#organization"
    }
  },
  {
    "@context": "https://schema.org",
    "@id": "https://decisioninsights.ai/author/decision-insights-threat-desk/#person",
    "@type": "Person",
    "description": "CISA advisories, vendor security bulletins, and CVE disclosures, summarized into sourced briefs. Produced under our Standards & Methodology.",
    "name": "Decision Insights Threat Desk",
    "sameAs": [
      "https://www.linkedin.com/showcase/decisioninsights/"
    ],
    "url": "https://decisioninsights.ai/author/decision-insights-threat-desk/"
  }
]

Is this your company? Get structured data for your own pages