CVE-2026-15195: Prototype Pollution in json-schema-ref-parser ≤15.3.5

Technical summary

CVE-2026-15195 is a prototype pollution weakness in json-schema-ref-parser affecting the lib/pointer.ts module. The vulnerability resides in the Refs.set and Pointer.set functions, which fail to properly sanitize or validate prototype-related object modifications. An authenticated remote attacker can craft malicious input to manipulate object prototypes, potentially affecting the integrity of runtime object properties across the affected application. The vulnerability is mitigated by patch a786bc6afc3674f650496472ee93d5cf74c4bd84, released in version 15.3.6.

Business impact

Prototype pollution vulnerabilities can allow attackers to modify core object behavior in JavaScript applications, potentially leading to privilege escalation, data tampering, or logic bypass. In the context of json-schema-ref-parser, this could compromise the integrity of schema validation and reference resolution, affecting downstream applications that rely on this library for API contract enforcement or configuration parsing. While the CVSS score is MEDIUM, organizations using this library in security-sensitive workflows should prioritize patching.

Affected systems

Applications and services that depend on apidevtools json-schema-ref-parser versions up to and including 15.3.5 are affected. This includes development tools, API gateway configurations, and backend services that use this library for OpenAPI/JSON Schema parsing and validation. The vulnerability requires authentication to exploit, limiting exposure to authenticated users or internal processes.

Exploitability

The vulnerability requires authentication (PR:L per CVSS vector) and network access, making it moderately exploitable. The attack complexity is low (AC:L), meaning no special techniques or timing conditions are required once an attacker has valid credentials. Remote exploitation is possible without user interaction, making this a concern for multi-tenant environments or systems where authentication can be compromised or easily obtained.

Remediation

Organizations should upgrade json-schema-ref-parser to version 15.3.6 or later as soon as practicable. This is a straightforward dependency update in most package management systems (npm, yarn, etc.). Testing should focus on schema validation workflows to ensure the patch does not introduce compatibility issues. For applications unable to upgrade immediately, implement network-level restrictions limiting authentication to trusted IP ranges and monitor for suspicious prototype pollution attempts.

Patch guidance

Upgrade json-schema-ref-parser from affected versions (up to 15.3.5) to 15.3.6 or later. Most projects manage this dependency via npm or yarn; update package.json and run install/upgrade commands. Verify the patch commit hash (a786bc6afc3674f650496472ee93d5cf74c4bd84) in your dependency tree if building from source. Test dependent functionality to confirm schema validation and reference resolution operate as expected post-upgrade. No breaking changes are anticipated, but validate against your internal test suite.

Detection guidance

Monitor application logs for unusual object property modifications or schema validation anomalies. Inspect requests from authenticated users that include nested prototype keys (e.g., __proto__, constructor, prototype) in schema definitions or reference payloads. Use static analysis tools to identify json-schema-ref-parser usage and version in your codebase. Enable verbose logging in the library if available to catch unexpected prototype mutations. Correlate authentication events with potential payload submissions that target prototype pollution vectors.

Why prioritize this

While the CVSS score is MEDIUM (6.3), this vulnerability warrants prompt patching due to its remote exploitability, low attack complexity, and the widespread use of json-schema-ref-parser in API infrastructure. Prototype pollution vulnerabilities are well-understood and actively researched; public exploits may emerge. The requirement for authentication reduces but does not eliminate risk, especially in multi-tenant or federated environments. Prioritize this against low-complexity, low-impact vulnerabilities, but defer to critical CVEs affecting unauthenticated attack surfaces.

Risk score, explained

CVSS 6.3 reflects a MEDIUM severity vulnerability: network-accessible, low attack complexity, authenticated access required, and impact limited to confidentiality, integrity, and availability within the application's privilege boundary. The score accurately captures the moderate risk; however, contextual factors—library ubiquity, prototype pollution prevalence, and API infrastructure dependency—may warrant elevated internal priority ratings in your risk model.

Frequently asked questions