CVE-2026-26021 is a critical prototype pollution flaw (CVSS 9.8) in the set-in npm package. An earlier fix can be bypassed using Array.prototype. Upgrade to set-in 2.0.5 and check transitive installs, since the package often arrives as a dependency of something else. The record does not list it in CISA's KEV catalog, and the advisory we read does not report exploitation.
What's affected
- set-in 2.0.1 up to, but not including, 2.0.5
- Fixed in 2.0.5
The advisory lists no workaround.
How to check if you're exposed
Ask npm which copies exist, including indirect ones:
npm ls set-in
Run it in every project and in each deployed build. Yarn and pnpm have equivalent commands. Check lockfiles too, because they decide what is actually installed.
Safeguard has a free in-browser dependency scan at https://gold.safeguard.sh/scan that reads a manifest or lockfile and flags known vulnerable packages, with no repository access needed.
What to do now
- Upgrade set-in to 2.0.5 or later wherever it is a direct dependency.
- For indirect copies, update the parent package, or use your package manager's override feature to force 2.0.5 until the parent releases.
- Rebuild and redeploy applications, since bundled frontends hold their own copies.
- Check where untrusted keys reach set-in in your own code, since that decides real exposure.
- Re-scan after the change to confirm the finding is gone.
Why it matters
CWE-1321 is improperly controlled modification of object prototype attributes. In JavaScript, nearly every object inherits from Object.prototype. If an attacker can write a property there, the change shows up in unrelated objects, which can turn into broken logic, bypassed checks or worse, depending on the application.
The advisory explains why the first fix failed. It checked user supplied keys against a list of forbidden strings using Array.prototype.includes. A check that relies on a built-in method is only as safe as that method, and the advisory describes a bypass based on altering it.
Reachability matters for triage. A vulnerable copy that never receives attacker controlled keys is lower risk than one fed from request bodies. Reachability analysis shows which of your call paths touch the package, so you can order the work. The 9.8 score is the worst case, and most real installs will need a closer look.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
It is only a transitive dependency. Do I care?
Yes, check it. Transitive copies are the usual way packages like this reach production. Whether it is reachable depends on how the parent uses it.
Is there a workaround?
The advisory lists none. Upgrade to 2.0.5.
Sources
Last reviewed: 19 October 2026.
