CVE-2026-73654: Prototype Pollution in Trigger.dev leading to Cascading Denial of Service

Vulnerability ID: CVE-2026-73654
CVSS Score: 8.5
Published: 2026-08-13

CVE-2026-73654 is a high-severity prototype pollution vulnerability in Trigger.dev. The flaw occurs during the handling of run-metadata updates through the PUT /api/v1/runs/:runId/metadata endpoint. Because user-supplied keys are parsed directly by the @jsonhero/path library without sanitization, an authenticated attacker with low privileges can pollute the global Object.prototype. This causes database queries via Prisma ORM to fail validation and induces unhandled exceptions in the Prometheus metrics client, resulting in a process-wide denial of service.

TL;DR

Unvalidated JSON path validation in the Trigger.dev metadata update endpoint allows authenticated attackers to pollute Object.prototype, crashing Prisma queries and Prometheus metrics client instances, resulting in a system-wide denial of service.

⚠️ Exploit Status: POC

Technical Details

• CWE ID: CWE-1321
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: Low (PR:L)
• Scope: Changed (S:C)
• Integrity Impact: Low (I:L)
• Availability Impact: High (A:H)
• CVSS Score: 8.5
• Exploit Status: PoC (Proof of Concept)
• CISA KEV Status: Not Listed

Affected Systems

• Trigger.dev Self-Hosted Platforms
• Trigger.dev Cloud Worker Nodes
• trigger.dev: >= 3.3.8, < 4.5.6 (Fixed in: 4.5.6)

Exploit Details

• GitHub Security Advisory: Vulnerability description and proof of concept references in the official repository advisory.

Mitigation Strategies

• Upgrade all Trigger.dev dependencies to version 4.5.6 or higher
• Deploy WAF content filtering rules to inspect and block prototype manipulation strings in dynamic metadata request paths

Remediation Steps:

1. 1. Update workspace dependencies by executing pnpm update @trigger.dev/core@4.5.6 or updating the root package.json file.
2. 2. Redeploy the self-hosted Trigger.dev platform with the patched version to refresh runtime worker nodes.
3. 3. Configure reverse proxy or WAF layer to identify and drop PUT requests containing prototype traversal segments if instant patching is impossible.

References

• GitHub Security Advisory GHSA-p28v-f755-9qrg
• Fix Commit 6997aeb05e27d2db47f9eda01fdc8a17c81a1ae0
• Pull Request #4316
• Release v4.5.6

Read the full report for CVE-2026-73654 on our website for more details including interactive diagrams and full exploit analysis.