CVE-2026-73654: Prototype Pollution in Trigger.dev leading to Cascading Denial of Service

CVE-2026-73654 identifies a high-severity prototype pollution vulnerability located in the core orchestration engine of Trigger.dev, an open-source background jobs and AI workflow platform. The flaw resides in the handling of run-metadata updates through the PUT /api/v1/runs/:runId/metadata API endpoint. Under normal operational conditions, this endpoint allows client applications to dynamically assign metadata payloads to execution states.\n\nAt the core of this vulnerability is the ingestion of user-defined JSON path notations by the @jsonhero/path library. The library processes these inputs without validation or sanitization of path segments. Consequently, the endpoint exposes a vector where unauthorized or low-privileged users can supply keys that traverse beyond the boundaries of local scope.\n\nAn attacker who possesses a standard environment API key can exploit this vulnerability to overwrite properties of the shared runtime base prototype. Because the server processes run metadata updates in the same Node.js execution context as other system processes, the resultant pollution affects all active operations. This leads to system-wide degradation, cascading errors in database drivers, and complete platform denial of service.

The root cause of CVE-2026-73654 is an improperly controlled modification of object prototype attributes, classified under CWE-1321. The vulnerability exists within the metadata operation processing pipeline defined in packages/core/src/v3/runMetadata/operations.ts. The implementation accepts client-supplied keys to perform fine-grained object manipulation within a run's state metadata.\n\nSpecifically, the application initializes a JSONHeroPath instance with a user-supplied key and invokes the .set() method. The target object is intended to be a simple dictionary representing execution metadata. However, the @jsonhero/path library resolves standard JSON path structures, including keys containing parent and root references, without checking for forbidden property names.\n\nWhen a client specifies a path containing the __proto__ property, the resolver navigates the object hierarchy and references the underlying Object.prototype. The subsequent assignment action writes the specified value directly onto this global prototype object. In Node.js runtimes, all plain JavaScript objects inherit from Object.prototype, meaning any attribute defined here immediately populates all subsequently instantiated objects.

The vulnerable implementation in packages/core/src/v3/runMetadata/operations.ts processed metadata operations by directly instantiating the path parser on client-controlled keys. The code lacked any verification step prior to invoking the mutation logic on the target metadata structure.\n\ntypescript\n// Vulnerable Code Path\n// User-controlled key was passed directly to the JSONHeroPath constructor\nnew JSONHeroPath(operation.key).set(newMetadata, value);\n\n\nThe remediation applied in commit 6997aeb05e27d2db47f9eda01fdc8a17c81a1ae0 addresses this by implementing a validation guard before any mutation is attempted. The application now iterates over incoming operations and evaluates each operation key using isSafeMetadataKey to block unsafe paths.\n\ntypescript\n// Patched Code Path in packages/core/src/v3/runMetadata/operations.ts\nfor (const operation of Array.isArray(operations) ? operations : [operations]) {\n // Prevent unsafe JSON paths and direct __proto__ assignments from changing Object.prototype.\n if (operation.type !== "update" && !isSafeMetadataKey(operation.key)) {\n unappliedOperations.push(operation);\n continue;\n }\n\n\nThe helper function isSafeMetadataKey in packages/core/src/v3/schemas/common.ts implements a multi-tiered defense against path-based pollution. It blocks both direct manipulation of __proto__ and any JSON path that splits into segments matching forbidden prototype attributes.\n\ntypescript\n// Validation logic in packages/core/src/v3/schemas/common.ts\nconst DANGEROUS_METADATA_KEY_SEGMENTS = new Set(["__proto__", "constructor", "prototype"]);\n\nexport function isSafeMetadataKey(key: string): boolean {\n if (!key.startsWith("$.")) {\n return key !== "__proto__";\n }\n\n return !key.split(/[.[\]'\u0022]+/).some((segment) => DANGEROUS_METADATA_KEY_SEGMENTS.has(segment));\n}\n\n\nThis fix is complete because it addresses all potential path traversal syntaxes that @jsonhero/path parses, including bracket notations and dot-notations. Additionally, it hardens the flattenAttributes utility, preventing telemetry ingestion mechanisms from causing similar pollution.

Exploitation of CVE-2026-73654 requires low privileges, specifically a standard workspace environment API key. The attacker must first obtain a valid run identifier associated with their workspace environment. This requirement makes the vulnerability accessible to compromised internal accounts or low-privileged workspace members.\n\nTo execute the attack, the adversary structures a PUT request targeting the /api/v1/runs/:runId/metadata endpoint. The body of the request contains an operations array designed to inject a key value that accesses the prototype. The JSON path $.__proto__.corruptedProperty is used as the target key.\n\njson\n{\n "operations": [\n {\n "type": "set",\n "key": "$.__proto__.corruptedProperty",\n "value": "trigger-denial-of-service"\n }\n ]\n}\n\n\nUpon receiving this request, the server executes the set operation, which traverses and updates Object.prototype.corruptedProperty. Once the pollution is achieved, the shared process immediately begins inheriting this property across all object instances. The diagram below illustrates the attack flow and subsequent process failures.\n\nmermaid\ngraph LR\n Attacker[\"Attacker (Low Privilege)\"] -->|HTTP PUT with polluted key| Endpoint[\"/api/v1/runs/:runId/metadata\"]\n Endpoint -->|Resolves $.\u005f\u005fproto\u005f\u005f| Engine[\"JSONHeroPath.set()\"]\n Engine -->|Modifies| Prototype[\"Global Object.prototype\"]\n Prototype -->|Inherited by| Prisma[\"Prisma ORM Builder\"]\n Prototype -->|Inherited by| PromClient[\"prom-client Metrics\"]\n Prisma -->|Validation Failure| DBError[\"Database Query Failure\"]\n PromClient -->|Unhandled Exception| Crash[\"Process Crash (DoS)\"]\n

The security impact of CVE-2026-73654 is evaluated as High, with a CVSS v3.1 score of 8.5. The vulnerability allows an authenticated attacker to execute a highly effective Denial of Service (DoS) attack that crosses tenant boundaries. This cross-tenant behavior justifies the Scope (S) parameter being classified as Changed.\n\nBecause Trigger.dev utilizes a shared webapp process architecture for multiple workspaces and tenants, the prototype pollution is not isolated to the attacker's workspace. Every tenant whose requests are handled by the polluted webapp node experiences database access failures due to Prisma ORM query builder crashes. Prisma identifies the polluted key as an invalid query parameter and throws immediate parsing errors.\n\nFurthermore, the Prometheus instrumentation client (prom-client) regularly iterates over global metrics configurations. When it processes properties from the polluted prototype, it encounters unexpected string values where numeric structures or labels are expected, leading to unhandled runtime exceptions. This crashes the main thread of the webapp container, disrupting background workers, authentication checks, and active workflows globally.

The primary remediation path for CVE-2026-73654 is to upgrade the Trigger.dev dependency suite and self-hosted instances to version 4.5.6 or later. This release integrates the proper input validation schemas and helper functions to neutralize prototype pollution payloads before they reach the path resolver.\n\nIf an immediate upgrade is not feasible, organizations running self-hosted instances should apply web application firewall (WAF) filtering. The WAF rules must inspect the payload of HTTP PUT requests targeted at paths ending in /metadata. Specifically, the rules must identify and block payloads containing the key words __proto__, constructor, or prototype when formatted inside JSON fields.\n\nAdditionally, developers are advised to audit custom metadata parsing logic to ensure that generic input parsing utilities do not trust unsanitized JSON path inputs. Implementing strict Zod schemas with refinement checks, as demonstrated in the patch, is the recommended security pattern for handling dynamic nested configurations in TypeScript.