piscina (npm) has 2 known vulnerabilities, the worst rated CRITICAL. Upgrade to 6.0.0-rc.5 or later to clear all of them. No malicious-package signal is recorded.
A prototype-pollution gadget in ThreadPool.options allows an attacker who can pollute Object.prototype to execute arbitrary code in Piscina worker threads…
CyberXYZ does not call a package safe in absolute terms. It records 2 known vulnerabilities for piscina (npm), the worst rated CRITICAL, and no malicious-package signal. Whether it is acceptable depends on the version you run.
Does piscina have known vulnerabilities?
Yes. CyberXYZ records 2 known vulnerabilities for piscina (npm), the worst rated CRITICAL. They are GHSA-67c8-pqhq-4rmx, GHSA-x9g3-xrwr-cwfg.
Which version of piscina should I use?
6.0.0-rc.5 or later clears every advisory recorded for piscina (npm). Check the release you pick before installing it.
How do I check piscina before installing?
Search piscina in CyberXYZ Check at https://cyberxyz.io/check?q=piscina. The xyz Scanner checks a project's dependencies, and CyberXYZ Proxy checks each package as it is installed.
Checked 2026-11-14 at 12:14 UTC. The most recent advisory here was published 2026-10-01. Updated continuously from NVD, GHSA, OSV and CNA feeds.