CVE-2026-44966

What it actually does

Velocity.js 2.1.5 and earlier can pollute Object.prototype while evaluating #set directives. If a template the attacker influences is rendered, inherited properties on every object can be overwritten, causing application-wide logic failures. Impact ranges from denial of service to remote code execution depending on how the Node.js host uses polluted properties.

Why it matters to the business

Products that let users supply or edit Velocity templates risk outages and, in some server-side JavaScript environments, unauthorized code execution with confidentiality and integrity effects. shepherdwind velocity.js is a shared template engine, so any application embedding 2.1.5 or earlier is in scope. The issue has been public for about 140 days, is not on CISA KEV, has no known exploit maturity, and a low EPSS (~0.006, up ~11% over 30 days). Treat as high severity where untrusted templates are rendered; mass exploitation is not currently indicated.

How an attack unfolds

An attacker who can influence a Velocity template processed by a vulnerable velocity.js instance uses a #set directive to write attacker-controlled keys onto Object.prototype. After render, later application logic that trusts object shape or inherited properties may crash, take unintended branches, or—in some server environments—reach dangerous sinks. No authentication is required if templates or template fragments are accepted from unauthenticated clients. No named threat actors or ransomware campaigns are associated with this CVE.

How to fix it

No patched version was listed with this intelligence. Stop rendering templates or #set content supplied or influenced by untrusted users. Inventory shepherdwind velocity.js (npm package velocity.js) at 2.1.5 and earlier and upgrade as soon as an upstream security release is published. Compensating controls: reject templates that reference prototype-related keys, isolate the template engine in a least-privilege process, and avoid passing polluted objects into dangerous sinks. Apply vendor updates if a downstream product embeds this library.

How to confirm the fix worked

Scan lockfiles, SBOM, and images for velocity.js 2.1.5 or earlier. Confirm production flows do not accept user-controlled Velocity templates. After an upgrade, verify the resolved version is newer than 2.1.5 and re-run dependency and container scans. In staging, render only trusted templates and confirm #set cannot change Object.prototype.

Typical attack path

1. Identify an application that renders Velocity templates with velocity.js 2.1.5 or earlier and accepts template content or fragments from untrusted input.
2. Submit a template whose #set directive targets the object prototype rather than a normal variable.
3. Cause the application to render that template so polluted properties apply globally for the process.
4. Trigger follow-on application behavior that inherits the polluted properties, producing denial of service or further code execution depending on the runtime.

How to detect it

There is no public exploit maturity and no named actors, so look for attempted prototype pollution in template traffic rather than a known implant. Review HTTP and API logs for template upload, preview, or render endpoints; inspect bodies and parameters for #set directives that mention prototype-related keys. On hosts running Node.js with velocity.js, review application error spikes, unexpected inherited properties, and process crashes after template renders. Check package manifests and node_modules for velocity.js <= 2.1.5 as exposure evidence, not proof of compromise.

• #set($__proto__
• #set(${__proto__
• #set($constructor.prototype
• __proto__
• constructor.prototype
• velocity.js

What your security team should do

• Immediately inventory all uses of shepherdwind velocity.js / npm velocity.js at 2.1.5 and earlier.
• Disable or tightly restrict rendering of untrusted Velocity templates until a patch is available and deployed.
• Subscribe to upstream velocity.js releases and patch as soon as a fixed version is published.
• Hunt retrospectively for prototype-pollution style #set content in template-related request logs (see detection_guidance).
• Prioritize internet-facing services that accept templates from unauthenticated users; KEV and exploit-maturity signals do not currently justify emergency mass-exploitation response.