Uncontrolled resource consumption in set-value
Priority MEDIUM 47CWE-400Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Denial of service
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Partial Red Hat: 5 fixed, 5 without a fix
Attack profile from CVSS 3.1 · NVD. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-400.
Summary
set-value is vulnerable to Prototype Pollution in versions lower than 3.0.1. The function mixin-deep could be tricked into adding or modifying properties of Object.prototype using any of the constructor, prototype and _proto_ payloads.
Why it matters now
EPSS 0.02475 84th percentileScored 2026-11-07
Fix Partial set-value (npm): 2.0.1, 3.0.1Red Hat: 2 advisoriesRed Hat: 5 fixed, 5 without a fix
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | set-value | All versions before 2.0.1 and version 3.0.0 | — | No fix listed | CNA |
| — | set-value (npm) | before 2.0.1 | 2.0.1 | Patch available | GHSA-4g88-fppr-53pp |
| — | set-value (npm) | 3.0.0 to before 3.0.1 | 3.0.1 | Patch available | GHSA-4g88-fppr-53pp |
- set-value Vendor— Affected All versions before 2.0.1 and version 3.0.0 Fixed in — No fix listed CNA
- set-value (npm) Vendor— Affected before 2.0.1 Fixed in 2.0.1 Patch available GHSA-4g88-fppr-53pp
- set-value (npm) Vendor— Affected 3.0.0 to before 3.0.1 Fixed in 3.0.1 Patch available GHSA-4g88-fppr-53pp
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:set-value_project:set-value:*:*:*:*:*:node.js:*:* | before 2.0.1; 3.0.0 to before 3.0.1 | Vulnerable | Set-value Project |
- cpe:2.3:a:set-value_project:set-value:*:*:*:*:*:node.js:*:* Versions before 2.0.1; 3.0.0 to before 3.0.1 Vulnerable ·Set-value Project
Remediation
- Fix · GHSA-4g88-fppr-53pp set-value (npm) Fixed in 2.0.1 Advisory →
- Fix · GHSA-4g88-fppr-53pp set-value (npm) Fixed in 3.0.1 Advisory →
Red Hat 2 advisories
- RHSA-2021:0549 Released 2021-02-16 · Red Hat rating Moderatenodejs:12 security update
- Red Hat Enterprise Linux AppStream (v. 8) nodejs-1:12.20.1-1.module+el8.3.0+9503+19cb079c.aarch64::nodejs:12, nodejs-1:12.20.1-1.module+el8.3.0+9503+19cb079c.ppc64le::nodejs:12, nodejs-1:12.20.1-1.module+el8.3.0+9503+19cb079c.s390x::nodejs:12 +19
- RHSA-2021:0485 Released 2021-02-11 · Red Hat rating Moderaterh-nodejs12-nodejs security update
- Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7) rh-nodejs12-nodejs-12.20.1-1.el7, rh-nodejs12-nodejs-devel-12.20.1-1.el7, rh-nodejs12-nodejs-docs-12.20.1-1.el7 +2
- Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.6) rh-nodejs12-nodejs-12.20.1-1.el7, rh-nodejs12-nodejs-devel-12.20.1-1.el7, rh-nodejs12-nodejs-docs-12.20.1-1.el7 +2
- Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.7) rh-nodejs12-nodejs-12.20.1-1.el7, rh-nodejs12-nodejs-devel-12.20.1-1.el7, rh-nodejs12-nodejs-docs-12.20.1-1.el7 +2
- Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7) rh-nodejs12-nodejs-12.20.1-1.el7, rh-nodejs12-nodejs-devel-12.20.1-1.el7, rh-nodejs12-nodejs-docs-12.20.1-1.el7 +2
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat Enterprise Linux 8 | Affected | No fix yet: Fix deferred |
| Red Hat OpenShift Container Platform 3.11 | Affected | No fix planned: Will not fix |
| Red Hat OpenShift Container Platform 4 | Affected | No fix planned: Will not fix |
| Red Hat OpenShift distributed tracing 2 | Affected | No fix yet: Fix deferred |
| Red Hat Software Collections | Affected | No fix yet: Fix deferred |
| Red Hat Enterprise Linux AppStream (v. 8) | Fixed | RHSA-2021:0549 |
| Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7) | Fixed | RHSA-2021:0485 |
| Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.6) | Fixed | RHSA-2021:0485 |
| Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.7) | Fixed | RHSA-2021:0485 |
| Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7) | Fixed | RHSA-2021:0485 |
Not affected: 1 product
- Red Hat Quay 3
Timeline
- 2026-10-02 Threatist record created from CVE-2019-10747
- 2026-10-03 Alias added: GHSA-4g88-fppr-53pp
References
Advisory 3
Other 7
- [drat-dev] 20191029 [GitHub] [drat] ottlinger opened a new issue #202: Fix security issue in set-value
- https://github.com/jonschlinkert/set-value/commit/95e9d9923f8a8b4a01da1ea138fcc39ec7b6b15f
- https://github.com/jonschlinkert/set-value/commit/cb12f14955dde6e61829d70d1851bfea6a3c31ad
- https://lists.apache.org/thread.html/b46f35559c4a97cf74d2dd7fe5a48f8abf2ff37f879083920af9b292@%3Cdev.drat.apache.org%3E
- https://lists.fedoraproject.org/archives/list/[email protected]/message/3EJ36KV6MXQPUYTFCCTDY54E5Y7QP3AV
- https://lists.fedoraproject.org/archives/list/[email protected]/message/E3HNLQZQINMZK6GYB2UTKK4VU7WBV2OT
- https://www.npmjs.com/advisories/1012
More Set-value Project Set-value vulnerabilities
- TI-2021-06132 Prototype pollution in set-value CVSS 3.1CRITICAL 9.8
Sources
- CVE-2019-10747 · CVE Program
- CVE-2019-10747 · NVD
- FIRST EPSS
- GHSA-4g88-fppr-53pp · GitHub Advisory Database · CC BY 4.0
- CVE-2019-10747 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences