The CVE-2026-73231 vulnerability in Faker's helpers.fake() function presents a deceptively simple technical flaw—access to the Function constructor via resolveProperty when certain function chains execute—but the deployment context makes this analytically significant rather than routine.
The CVSS of 7.8 (HIGH) and EPSS of 0.00154 create a genuine gap, not a scoring artifact. The low EPSS reflects reality: Faker is a development dependency, and most organizations using it in test suites face near-zero practical risk. However, Faker routinely leaks into production through three vectors that security teams often miss: dependency bloat where it arrives transitively through testing utilities, webpack configurations that bundle the full dependency tree, and SSR pipelines where test utilities are inadvertently compiled into runtime. When Faker reaches production, attacker-controlled input to helpers.fake() becomes a realistic attack surface—especially in any user-facing feature generating formatted fake data dynamically.
The deeper problem is architectural, not patchable. Faker's core value proposition is arbitrary code execution: helpers.fake() is designed to take template strings and execute them as code. The 10.5.0 fix likely restricted the resolveProperty access path, but this constrains a function that was explicitly built to do what the vulnerability exploits. If the fix is too restrictive, it breaks legitimate documented use cases; if not restrictive enough, the escape persists via a different path. This is the same mutation cycle seen in template engine sandbox escapes and testing library leaks—each patched locally, none addressed structurally.
Before deprioritizing this as a "dev dependency only" issue, audit your build pipeline. Determine whether Faker appears in production bundles, and whether any user input flows through helpers.fake. The temporal dimension matters: organizations that deprioritize based on EPSS often carry this vulnerability forward for 18+ months, accumulating additional bundled dependencies in the interim. The question isn't merely whether Faker exists in your artifact, but how long it has existed unpatched and what else has been bundled alongside it.