PT-2021-17969 · Npm · Node.Js Mixme

Cyber-Dude1 · CVE-2021-28860 · Published 2021-05-03 · Updated 2026-07-05

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

Name of the Vulnerable Software and Affected Versions: Node.js mixme versions prior to 0.5.1

Description: The issue allows an attacker to add or alter properties of an object via proto through the mutate() and merge() functions. The polluted attribute will be directly assigned to every object in the program, putting the availability of the program at risk and causing a potential denial of service (DoS).

Recommendations: For versions prior to 0.5.1, update to version 0.5.1 or later to resolve the issue. As a temporary workaround, consider disabling the mutate() and merge() functions until a patch is available.

Fix

DoS

Prototype Pollution

Weakness Enumeration

CWE-1321

CWE-913

Related Identifiers

CVE-2021-28860

GHSA-79JW-6WG7-R9G4

GHSA-R5CQ-9537-9RPF

Affected Products

Node.Js Mixme

References · 15

• https://github.com/adaltas/node-mixme/commit/cfd5fbfc32368bcf7e06d1c5985ea60e34cd4028 · Patch
• https://github.com/adaltas/node-mixme/security/advisories/GHSA-79jw-6wg7-r9g4 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2021-28860 · Security Note
• https://osv.dev/vulnerability/GHSA-79jw-6wg7-r9g4 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-29491 · Security Note
• https://osv.dev/vulnerability/CVE-2021-28860 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-r5cq-9537-9rpf · Vendor Advisory
• https://github.com/adaltas/node-mixme/issues/1 · Note
• https://github.com/adaltas/node-mixme · Note
• https://security.netapp.com/advisory/ntap-20210622-0002 · Note
• https://t.me/cveNotify/186170 · Telegram Post
• https://npmjs.com/~david · Note
• http://nodejs.com · Note
• https://security.netapp.com/advisory/ntap-20210618-0005 · Note
• https://t.me/cvenotify/16534 · Telegram Post