CVE-2026-73654: Trigger.dev Prototype Pollution Risk and Fix

CVE-2026-73654 affects @trigger.dev/core versions 3.3.8 through 4.5.5. A caller with a normal environment API key can submit a crafted run-metadata operation that modifies Object.prototype inside the Trigger.dev webapp process. Teams using an affected self-hosted deployment should upgrade to 4.5.6 now.

The vulnerability received a CVSS score of 8.5 because one low-privilege request can disrupt other tenants that share the process. The Trigger.dev advisory was published on August 13, 2026.

How the Trigger.dev prototype pollution happens

Trigger.dev lets clients update run metadata through PUT /api/v1/runs/:runId/metadata. The vulnerable implementation converts the client-controlled operation.key into a JSON path and writes a value at that path. It did not reject the dangerous JavaScript path segments __proto__, constructor, or prototype.

That distinction matters. The malicious value is not confined to one run's metadata object. It reaches Object.prototype, from which ordinary objects across the Node.js process can inherit it.

The advisory documents two practical consequences. Prisma queries can receive an unexpected inherited property and fail validation. Prometheus client code can also encounter the property as an undeclared label and throw an uncaught exception. In a shared webapp process, this can interrupt worker authentication and job processing for tenants that did not send the original request.

This is an authenticated denial-of-service path, not an unauthenticated internet-wide takeover. The attacker needs a valid environment API key and a run ID belonging to that environment. The advisory demonstrates process crashes and a cross-tenant availability impact, but it does not establish confirmed exploitation in the wild or data theft.

Check whether your deployment is exposed

Start with the installed package version:

npm ls @trigger.dev/core

For pnpm projects, use:

pnpm why @trigger.dev/core

Versions from 3.3.8 through 4.5.5 are affected. Version 4.5.6 contains the fix. Check the resolved version in the lockfile as well as package.json, since a range can resolve differently across deployments.

Finding the package is not enough to prove that an application is remotely exploitable. The vulnerable sink is in Trigger.dev's run-metadata processing path. Risk is highest when you self-host the affected Trigger.dev webapp, expose its API to environment-key holders, and share that process across projects or tenants. An application that only uses a client SDK against a separately managed patched service does not automatically expose the vulnerable endpoint in its own process.

Review API-key handling while checking versions. A leaked development environment key can satisfy the advisory's privilege requirement. Search CI logs, deployment variables, support bundles, and copied .env files for unnecessary exposure, then rotate keys that may have escaped their intended boundary.

Upgrade to 4.5.6 and verify the running image

Upgrade the affected package and regenerate the lockfile with your normal package manager:

npm install @trigger.dev/core@4.5.6

Trigger.dev's 4.5.6 release blocks dangerous prototype path segments before metadata operations are applied. The fix commit also adds regression coverage for the affected operation types.

For self-hosted deployments, rebuilding is not the end of the job. Confirm that the running container uses the patched artifact, replace old replicas, and verify the version inside the deployed image. Watch webapp restarts, uncaught exceptions, Prisma validation errors containing unexpected fields, and sudden worker dequeue failures. These signals are not proof of this attack, but they can reveal residual exposure or an unhealthy rollout.

If an immediate upgrade is impossible, restrict access to the metadata update route, rotate environment keys, and isolate tenants into separate processes where practical. Treat those as temporary controls. Application-side validation alone is easy to miss because every metadata operation reaches the same path setter.

What automated dependency checks can miss

A dependency scanner can flag the affected version. It cannot determine whether a production image actually contains the patched package, whether old replicas remain reachable, whether environment keys leaked, or whether multiple tenants share the vulnerable process.

That gap is why this issue deserves more than a lockfile update. VibeAudits combines automated dependency checks with human review of deployment boundaries, secret handling, authorization, background-job infrastructure, and the code paths that accept untrusted metadata. If Trigger.dev is part of a production SaaS or AI workflow, book a VibeAudits code audit to verify the fix in its real application context.