CVE-2026-44966 is a high severity prototype pollution flaw (CVSS 8.3) in velocityjs 2.1.5 and earlier, a JavaScript Velocity template engine. Rendering an attacker controlled template can change Object.prototype. The advisory lists no patched version, so do not render untrusted templates at all.
What's affected
From the project advisory for the velocityjs npm package:
- Affected: 2.1.5 and earlier.
- Fixed: the advisory lists no patched version. Check the npm page and the repository for a newer release before you rely on this.
The risk applies only when template content can be influenced by untrusted users. If your templates are fixed files that you wrote, and users supply only data, the described path is not open.
How to check if you're exposed
Find the package in your tree:
npm ls velocityjs
npm explain velocityjs
Then find where templates come from. Any place where a user, a tenant, a database field or an uploaded file supplies template text, rather than data for a fixed template, is the exposure.
What to do now
- Check for a release newer than 2.1.5 and upgrade if one exists.
- Do not render templates from untrusted sources. Pass untrusted input only as data.
- If you must keep the package, run template rendering in a separate process with limited privileges.
- Consider freezing the prototype at startup in Node, using Object.freeze on Object.prototype, but test your application first because some libraries depend on changing it.
Why it matters
The class is CWE-1321 (improperly controlled modification of object prototype attributes). The #set directive assigns values along a path of keys. The code did not block special names such as __proto__, so a path through them reaches the shared prototype.
Changing the prototype affects every object in the process. The advisory says this can cause denial of service or, depending on the environment, remote code execution. The record does not mark this CVE as KEV.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Is there a fix?
The advisory lists none. Watch the repository, and avoid rendering untrusted templates.
Sources
Last reviewed: 19 October 2026.
