CASL Ability is Vulnerable to Prototype Pollution

CRITICAL 9.8CVE-2026-1774 · GHSA-x9vf-53q3-cvx6 · Published 10/02/2026 · updated 17/06/2026

Package	Affected versions	Patched versions
@casl/ability npm	`≥ 2.4.0, < 6.7.5`	`6.7.5`

Description

CASL Ability, versions 2.4.0 through 6.7.4, contains a prototype pollution vulnerability.

NVD description

CASL Ability, versions 2.4.0 through 6.7.4, contains a prototype pollution vulnerability.

Running one of these products? Scan your site to see whether it exposes a vulnerable version.