CVE-2026-34221 is a critical (CVSS 9.1) prototype pollution flaw in MikroORM, the TypeScript ORM for Node.js, in its internal Utils.merge helper. Fixed versions are 6.6.10 and 7.0.6. Upgrade @mikro-orm/core on the matching major line and avoid passing raw user input into ORM calls.
What's affected
The project's advisory (GHSA-qpfv-44f3-qqx6) lists @mikro-orm/core 6.6.9 and earlier on the 6.x line, and 7.0.5 and earlier on the 7.x line. Patched releases are 6.6.10 and 7.0.6.
The flaw is in Utils.merge, which MikroORM uses internally to combine object structures. It did not block the special keys __proto__, constructor and prototype, so attacker-controlled input could change the JavaScript object prototype when merged.
The advisory says exploitation needs application code that passes untrusted input into ORM operations that merge objects, such as entity property assignment or building query conditions.
How to check if you're exposed
Check the installed version in each service:
npm ls @mikro-orm/core
Compare it against 6.6.10 and 7.0.6. Then search your code for places where request bodies or query strings go straight into em.assign, create or filter conditions. Those are the spots the advisory describes.
Paste a lockfile or manifest into the free in-browser dependency scan to see whether the package is in your tree, including as a transitive dependency. Reachability analysis then helps you judge whether your code calls the affected path, so you can order the work sensibly.
A quick way to find exposed spots is to search for calls like assign( and create( where the argument comes from a request body. Anything that forwards req.body unchanged is a candidate.
What to do now
- Find the services that use MikroORM and note the major version.
- Upgrade to 6.6.10 on the 6.x line or 7.0.6 on the 7.x line.
- Validate request bodies against a schema before they reach ORM calls, and drop unknown keys.
- Reject keys named
__proto__,constructorandprototypein untrusted input at the edge. - Retest your critical flows after the upgrade.
Why it matters
The weakness is CWE-1321, improperly controlled modification of object prototype attributes. In JavaScript, nearly every object inherits from a shared prototype. If an attacker can write to it, they change the behavior of objects across the whole process.
The advisory says this may lead to denial of service or unexpected behavior, and in certain scenarios polluted properties may influence query construction and potentially lead to SQL injection. The risk is therefore tied to how your application uses the ORM, which is why reachability matters here: a vulnerable version that never merges untrusted input is a lower priority than one that does.
The record does not mark this CVE as exploited and it is not on the CISA KEV list.
A cheap safeguard for Node applications is to use schema validation on every input, with a library that rejects unknown properties. It protects against this CVE and many other prototype pollution paths, because the dangerous keys never reach internal helpers. Node.js also offers runtime options that remove the __proto__ accessor, though they can break libraries that depend on it, so test before using one.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Does every MikroORM app have the problem?
No. The advisory says exploitation needs untrusted input to reach ORM operations that merge objects. Still, upgrade, because that is easy to do by accident.
Sources
Last reviewed: 19 October 2026.
