The vulnerability lies in the rulesToFields function of @casl/ability versions 6.7.5 up to 7.0.2, where an attacker controlling rule conditions can supply dotted keys such as "toString.call" to alter the prototype of Object.prototype. This prototype pollution modifies shared builtin functions throughout the Node.js process, resulting in a denial of service as the process may crash or hang. The weakness is classified as CWE‑1321. The impact is restricted to the Node.js process that loaded the library and does not provide arbitrary code execution.

Node.js applications that include the @casl/ability library from stalniy, specifically any deployment using versions 6.7.5 through 7.0.1. The issue does not affect other npm packages unrelated to @casl/ability.

The CVSS score of 6.0 indicates moderate severity, while the EPSS score of less than 1% signals a low probability of exploitation in the wild; the vulnerability is not listed in the CISA KEV catalogue. Attackers would need the ability to supply or influence rule conditions in the application, which is typically possible when user input is passed directly to the rules engine. Successful exploitation would lead to a denial of service within the affected Node.js process, potentially disrupting services that rely on that process.