CVE-2026-14893

The IBM Instana Node.js tracer component is susceptible to prototype pollution via its configuration normalization API, affecting versions 1.0.303 through 1.0.320. This vulnerability can lead to unauthorized manipulation of object prototypes, potentially allowing attackers to execute arbitrary code or alter application behavior. Organizations using affected versions of IBM Observability with Instana should prioritize remediation to mitigate the risk of exploitation.