CVE-2026-2964 is a medium severity flaw (CVSS 5.0) in higuma web-audio-recorder-js. The extend function in lib/WebAudioRecorder.js handles dynamic configuration in a way that allows the properties of an object prototype to be modified. The record says the attack is complex and difficult, but the exploit is public.
What's affected
The NVD record lists web-audio-recorder-js versions 0.1 and 0.1.1. The NVD record does not name a fixed version, so assume every copy you run is exposed until the maintainer says otherwise. The vendor was contacted early about this disclosure but did not respond, according to the record. The public disclosure and the record are the only sources for this issue.
How to check if you're exposed
Find out whether higuma web-audio-recorder-js runs anywhere in your environment, including test servers and old demos. Run npm ls web-audio-recorder-js if it is a dependency, and search bundled files for WebAudioRecorder.js. Run the free in-browser dependency scan at https://gold.safeguard.sh/scan to see whether the affected package is in your lockfile or SBOM.
Then check who can reach it. A copy that is open to the internet is the case that matters most, so review the web server, reverse proxy and firewall rules for that host.
What to do now
- Remove higuma web-audio-recorder-js from any internet-facing host, or restrict it to a trusted network or VPN.
- Check the project page and the maintainer's contact channels for a fix, and apply it if one has appeared since this was written.
- Search your front end bundles and vendored directories for
WebAudioRecorder.jsand note the version. - Avoid passing untrusted data as recorder configuration, so that no user input reaches the extend function.
- Consider a maintained audio recording library if you depend on this one, since the maintainer did not respond.
- Keep a list of small third party applications like this one, so a new advisory can be matched against it quickly. The Gold page for this CVE has the latest data: https://gold.safeguard.sh/vulnerability/CVE-2026-2964
Why it matters
The record files this under CWE-1321 and CWE-94. The record files this under CWE-1321 and CWE-94, improperly controlled modification of object prototype attributes, and code injection. In JavaScript, nearly every object inherits from a shared prototype. A merge or extend function that copies keys from untrusted input without filtering can write to that shared prototype and change behaviour across the whole application. The impact depends on how your app uses the polluted properties. The fix is to skip dangerous keys when merging, which only the maintainer or your own fork can do.
The NVD description says the exploit is public, so anyone can read how the weakness works. A public write-up and no vendor fix is a poor mix for a system that holds real data, which is why exposure control is the main defence here. The record does not mark this CVE as exploited in the wild, and it is not in the CISA KEV catalog.
Quick check
Why is the score only 5.0?
The vector marks attack complexity as high and needs a low privilege account.
Do I need to act if I do not use it?
No. This only matters if the library is in your application or bundle.
Sources
Last reviewed: 19 October 2026.
