CVE-2026-1774
Critical · 9.8CVSS
9.8
EPSS
0.7%
Published
Feb 10, 2026
CISA due date
—
The record
CASL Ability, versions 2.4.0 through 6.7.4, contains a prototype pollution vulnerability.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| npm | @casl/ability | 2.4.0 | 6.7.5 |