CVE-2026-48819 is a medium-severity security vulnerability in @hey-api/openapi-ts (npm), affecting versions < 0.97.3. It is fixed in 0.97.3.
Summary dist/clients/core/params.ts in @hey-api/openapi-ts ships a runtime template that is copied verbatim into every generated SDK as params.gen.ts. When a caller passes an object argument containing an unknown key starting with a slot prefix ($body, $headers, $path, $query), the function strips the prefix and writes the remainder directly to that slot without validation. The key "$queryproto" causes the returned params.query object to have its prototype chain substituted with attacker-controlled data. The issue is present in all versions through at least 0.97.2. Details The vulnerable branch in dist/clients/core/params.ts: This branch runs for any key that (1) is not registered in the field map and (2) starts with one of the four slot prefixes. When a caller passes "$queryproto" as an extra key alongside a legitimate field, the key is not in the field map, key.startsWith("$query") is true, and key.slice(7) produces "proto". The bracket-write params["query"]["proto"] = value invokes the proto setter, which calls Object.setPrototypeOf(params.query, value). Reachability. Every generated endpoint method that accepts an object argument passes it through buildClientParams. If the application forwards user-supplied request parameters to a generated client method, a common pattern in proxy servers, BFF layers, and API gateways, an attacker can include "$queryproto" alongside a legitimate field (e.g. "q"). The legitimate field ensures stripEmptySlots does not remove the affected slot (it has at least one own key), so the poisoned params.query object is returned to the caller. Concrete field config that hey-api generates for a GET endpoint with one query param q: A request { q: "hello", "$queryproto": { isAdmin: true } } reaches this call with "q" going to the field map branch and "$queryproto" falling through to extraPrefixes. PoC poc.ts: Expected output: No sentinel key is needed. The legitimate field "q" keeps params.query alive through stripEmptySlots. reproduce.zip Impact The returned params.query object has its prototype chain substituted with the attacker-supplied value. Any downstream code that iterates it with for..in (e.g., when serializing query parameters for an outgoing HTTP request) will enumerate the injected keys alongside legitimate ones. Applications that check inherited properties on the params object for routing or authorization decisions are also affected. Global Object.prototype is not modified, impact is limited to the returned slot object and its consumers. Every npm package generated by @hey-api/openapi-ts carries this template. Downstream packages include @opencode-ai/sdk, @trigger.dev/sdk, and others. A fix in the template propagates to all of them on regeneration.
CVE-2026-48819 has a CVSS score of 4.8 (Medium). The vector is network-reachable, no privileges required, and no user interaction. A CVSS score reflects the worst-case severity of the vulnerability, not your specific exposure. Whether this affects your application depends on whether the vulnerable code is present and reachable in your environment.
A fixed version is available (0.97.3). Upgrading removes the vulnerable code path.
npm
@hey-api/openapi-ts (< 0.97.3)@hey-api/openapi-ts → 0.97.3 (npm)Severity tells you how bad this could be in the worst case. It does not tell you whether you are exposed. Exploitability and impact are functions of runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A vulnerable package can sit in your dependency tree and never run.
Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter instead of chasing every advisory.
Kodem's runtime-powered SCA identifies whether CVE-2026-48819 is reachable in your applications. Explore open-source security for your team.
See if CVE-2026-48819 is reachable in your applications. Get a demo
Already deployed Kodem? See CVE-2026-48819 in your environment →Upgrade @hey-api/openapi-ts to 0.97.3 or later to resolve this vulnerability.
Kodem Kai can prioritize this vulnerability in your dependency tree and generate a fix recommendation.
CVE-2026-48819 is a medium-severity security vulnerability in @hey-api/openapi-ts (npm), affecting versions < 0.97.3. It is fixed in 0.97.3.
CVE-2026-48819 has a CVSS score of 4.8 (Medium). This score reflects the worst-case severity of the vulnerability, not your specific exposure. Whether it represents real risk in your environment depends on whether the vulnerable code is present and reachable.
@hey-api/openapi-ts (npm) versions < 0.97.3 is affected.
Yes. CVE-2026-48819 is fixed in 0.97.3. Upgrade to this version or later.
Whether CVE-2026-48819 is exploitable in your environment depends on whether the vulnerable code is present and reachable. A CVSS score is a worst-case rating; it does not account for your specific deployment, configuration, or usage patterns. Kodem, an Intelligent Application Security platform, uses runtime intelligence to show which vulnerabilities actually execute in production, so you can focus on the ones that represent real risk. Get a demo
Exploitability and impact are not fixed properties of a CVE. They depend on runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A high CVSS score on a dependency that never runs is not the same as real risk. Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter.
Upgrade @hey-api/openapi-ts to 0.97.3 or later.