CVE-2026-34221
Mikro-Orm Mikroorm ≤ 6.6.10
Raw vector
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:XCVSS and EPSS are reproduced from their sources (NVD, FIRST EPSS). Risk Priority is our own derived reading, not an NVD score.
Summary
CVE-2026-34221 is a high-severity Prototype Pollution (CWE-1321) vulnerability in Mikro-Orm Mikroorm. Its CVSS base score is 8.3 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Command and Scripting Interpreter (T1059); ranked at the 31th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
CVE-2026-34221 is a prototype pollution vulnerability in MikroORM, a TypeScript ORM for Node.js based on Data Mapper, Unit of Work, and Identity Map patterns. The flaw exists in the Utils.merge helper function used internally for merging object structures, which does not block special keys such as __proto__, constructor, or prototype. This allows attacker-controlled input to modify the JavaScript object prototype during merging. The vulnerability affects MikroORM versions prior to 6.6.10 and 7.0.6.
Unauthenticated attackers can exploit this vulnerability remotely over the network with low attack complexity, requiring no privileges or user interaction. By supplying crafted input to the merge function, they can pollute the global object prototype, enabling arbitrary code execution or denial-of-service conditions. The issue carries a CVSS 3.1 base score of 9.1 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H) and is classified under CWE-1321.
The vulnerability has been addressed in MikroORM versions 6.6.10 and 7.0.6. Additional details on the patch and remediation are available in the GitHub security advisory at https://github.com/mikro-orm/mikro-orm/security/advisories/GHSA-qpfv-44f3-qqx6.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-17488
Vulnerability Data
MikroORM is a TypeScript ORM for Node.js based on Data Mapper, Unit of Work and Identity Map patterns. Prior to versions 6.6.10 and 7.0.6, a prototype pollution vulnerability exists in the Utils.merge helper used internally by MikroORM when merging object…
more
structures. The function did not prevent special keys such as __proto__, constructor, or prototype, allowing attacker-controlled input to modify the JavaScript object prototype when merged. This issue has been patched in versions 6.6.10 and 7.0.6.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
—
—
—
V15.3.6
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Secure SDLC practices directly require input validation and safe property assignment to prevent prototype pollution.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Secure development lifecycle mandates input validation and object-handling controls that directly prevent prototype pollution.
Application security requirements explicitly call for safeguards against unsafe object attribute manipulation.
Secure architecture principles reduce the likelihood of prototype pollution through safe design patterns.
Secure coding standards directly prohibit unsafe prototype attribute assignment and require defensive checks.
Security testing in development catches prototype-pollution flaws before release.
Change-management processes ensure security fixes for prototype-pollution issues are tracked and deployed.