critical9.1
CVE-2021-28860
Prototype Pollution in mixme
Impact
Node.js mixme 0.5.0, an attacker can add or alter properties of an object via '__proto__' through the mutate() and merge() functions. The polluted attribute will be directly assigned to every object in the program. This will put the availability of the program at risk causing a potential denial of service (DoS).
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| npm | mixme | < 0.5.1 | 0.5.1 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Adaltas | Mixme | before 0.5.1 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://github.com/adaltas/node-mixme/commit/cfd5fbfc32368bcf7e06d1c5985ea60e34cd4028
- https://github.com/adaltas/node-mixme/issues/1
- https://github.com/adaltas/node-mixme/security/advisories/GHSA-79jw-6wg7-r9g4
- https://security.netapp.com/advisory/ntap-20210618-0005/
- https://www.npmjs.com/~david
- https://github.com/advisories/GHSA-r5cq-9537-9rpf
- https://nvd.nist.gov/vuln/detail/CVE-2021-28860
- http://nodejs.com