CVE-2026-85625: sift Prototype Pollution Scores 9.2, With No Patched Version

CVE-2026-85625 covers crcn sift.js through version 17.1.3, and there is no patched release. NVD published it on September 4, 2026. VulnCheck assigned a CVSS 4.0 base score of 9.2, critical, while CVSS 3.1 scores the same issue 8.1, high, under CWE-1321 prototype pollution. npm still reports 17.1.3 as dist-tags.latest.

The mechanism is two bugs meeting. Version 17.1.3 enumerates query keys with for...in, which walks the prototype chain, then dispatches any matched operator key, $where included. $where compiles its string value into a function through new Function unless CSP_ENABLED is set, and it is not set by default. Set Object.prototype.$where from any separate pollution primitive in the process and even sift({}) runs attacker JavaScript. Passing an untrusted query object that carries a string $where executes code directly.

The reach is what makes this expensive. sift arrives as a transitive dependency inside filter and query layers, so the vulnerable code belongs to a package you never chose, and the reporter's GitHub issue has sat open since July 6, 2026 with no fixed version published. A 9.2 under CVSS 4.0 is not a score you can defer to a quarterly dependency sweep.

Run npm ls sift: if it shows up, set CSP_ENABLED to disable $where compilation, stop passing user-controlled query objects into sift, or drop the dependency. There is no version to upgrade to, so one of those three is your patch.