High severity8.3GHSA Advisory· Published May 26, 2026· Updated Jun 2, 2026
CVE-2026-44966
CVE-2026-44966
Description
Velocity.js is a JavaScript implementation of the Apache Velocity template engine. In 2.1.5 and earlier, a prototype pollution vulnerability was discovered in velocityjs. This issue occurs during the processing of #set directives in Velocity templates. If an application renders a template controlled by an attacker, it is possible to modify Object.prototype, potentially leading to Denial of Service (DoS) or Remote Code Execution (RCE) depending on the server environment.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
velocityjsnpm | <= 2.1.5 | — |
Affected products
3<= 2.1.5+ 1 more
- (no CPE)range: <= 2.1.5
- cpe:2.3:a:shepherdwind:velocity.js:*:*:*:*:*:node.js:*:*range: <=2.1.5
Patches
Vulnerability mechanics
References
3- github.com/shepherdwind/velocity.js/security/advisories/GHSA-j658-c2gf-x6pqnvdExploitVendor AdvisoryWEB
- github.com/advisories/GHSA-j658-c2gf-x6pqghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2026-44966ghsaADVISORY
News mentions
0No linked articles in our index yet.