Ecosystem	Package	Version

Vulnerabilities

CVE-2026-1774

CVE-2026-1774

CASL Ability, versions 2.4.0 through 6.7.4, contains a prototype pollution vulnerability.

Published Feb 12, 2026

https://github.com/advisories/GHSA-x9vf-53q3-cvx6

CVSS ScoreCritical

9.3

Ecosystem	Package	Version


npm	@casl/ability	2.4.0
npm	@casl/ability	2.4.1
npm	@casl/ability	2.4.2
npm	@casl/ability	2.5.0
npm	@casl/ability	2.5.1
npm	@casl/ability	3.0.0
npm	@casl/ability	3.0.1
npm	@casl/ability	3.0.2
npm	@casl/ability	3.1.0
npm	@casl/ability	3.1.1
npm	@casl/ability	3.1.2
npm	@casl/ability	3.2.0
npm	@casl/ability	3.3.0
npm	@casl/ability	3.4.0
npm	@casl/ability	4.0.0
npm	@casl/ability	4.0.1
npm	@casl/ability	4.0.2
npm	@casl/ability	4.0.3
npm	@casl/ability	4.0.4
npm	@casl/ability	4.0.5
npm	@casl/ability	4.0.6
npm	@casl/ability	4.0.7
npm	@casl/ability	4.0.8
npm	@casl/ability	4.1.0
npm	@casl/ability	4.1.1
npm	@casl/ability	4.1.2
npm	@casl/ability	4.1.3
npm	@casl/ability	4.1.4
npm	@casl/ability	4.1.5
npm	@casl/ability	4.1.6
npm	@casl/ability	5.0.0
npm	@casl/ability	5.0.1-next.1
npm	@casl/ability	5.1.0-next.10
npm	@casl/ability	5.1.0-next.11
npm	@casl/ability	5.1.0-next.12
npm	@casl/ability	5.1.0-next.13
npm	@casl/ability	5.1.0-next.14
npm	@casl/ability	5.1.0-next.15
npm	@casl/ability	5.1.0-next.1
npm	@casl/ability	5.1.0-next.2
npm	@casl/ability	5.1.0-next.3
npm	@casl/ability	5.1.0-next.4
npm	@casl/ability	5.1.0-next.5
npm	@casl/ability	5.1.0-next.6
npm	@casl/ability	5.1.0-next.7
npm	@casl/ability	5.1.0-next.8
npm	@casl/ability	5.1.0-next.9
npm	@casl/ability	5.1.0
npm	@casl/ability	5.1.1
npm	@casl/ability	5.1.2

CVE-2026-1774 | Components Impacted | Sonatype Guide | Sonatype Guide