CVE-2026-2964: Prototype Pollution in web-audio-recorder-js

Prototype pollution occurs when an attacker can modify the prototype of built-in JavaScript objects or user-defined constructor functions. In this case, manipulating the prototype of WebAudioRecorder.js could allow an attacker to inject malicious properties or override existing ones, potentially leading to denial-of-service, information disclosure, or even remote code execution depending on how the application utilizes the modified prototype. The availability of a public exploit significantly increases the risk, as it lowers the barrier to entry for attackers. The complexity of the attack is considered difficult, but the public availability of the exploit mitigates this concern.

1. Reserved2026-02-22
2. Published2026-02-23
3. EPSS updated2026-03-23

The primary mitigation is to upgrade to a patched version of web-audio-recorder-js. As no fixed version is currently available, consider removing or disabling the web-audio-recorder-js component if possible. If removal is not feasible, implement strict input validation on any data used by the extend function to prevent malicious input from reaching the prototype. Monitor application logs for unusual behavior or unexpected property modifications. Consider using a Web Application Firewall (WAF) to filter requests that attempt to manipulate object prototypes.