Read the docs
TI-2021-02827 Aliases CVE-2021-3918GHSA-896r-f27r-55mw

Prototype Pollution in kriszyp/json-schema

Priority MEDIUM 49CWE-1321Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Tampering
Confidentiality · integrity · availability
High · High · High
Fix status
Partial Red Hat: 6 fixed, 8 without a fix

Attack profile from CVSS 3.1 · NVD. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-915.

Summary

json-schema is vulnerable to Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')

Why it matters now

EPSS 0.0383 90th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Partial json-schema (npm): 0.4.0Red Hat: 8 advisoriesRed Hat: 6 fixed, 8 without a fix

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
kriszypkriszyp/json-schemaup to 0.3.0—No fix listedCNA
—json-schema (npm)before 0.4.00.4.0Patch availableGHSA-896r-f27r-55mw
  • kriszyp/json-schema Vendorkriszyp Affected up to 0.3.0 Fixed in — No fix listed CNA
  • json-schema (npm) Vendor— Affected before 0.4.0 Fixed in 0.4.0 Patch available GHSA-896r-f27r-55mw

CPE configurations NVD · 2

CPEVersionsRoleVendor
cpe:2.3:a:json-schema_project:json-schema:*:*:*:*:*:*:*:*before 0.4.0VulnerableJson-schema Project
cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*10.0VulnerableDebian
  • cpe:2.3:a:json-schema_project:json-schema:*:*:*:*:*:*:*:* Versions before 0.4.0 Vulnerable ·Json-schema Project
  • cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:* Versions 10.0 Vulnerable ·Debian

Remediation

  • Fix · GHSA-896r-f27r-55mw json-schema (npm) Fixed in 0.4.0 Advisory →

Red Hat 8 advisories

  • RHSA-2022:7055 Released 2022-10-19 · Red Hat rating Moderate
    RHOSDT 2.6.0 operator/operand containers Security Update
    • Red Hat OpenShift distributed tracing 2.6 rhosdt/opentelemetry-collector-rhel8, rhosdt/opentelemetry-rhel8-operator
  • RHSA-2022:4956 Released 2022-06-09 · Red Hat rating Important
    Red Hat Advanced Cluster Management 2.5 security updates, images, and bug fixes
    • Red Hat Advanced Cluster Management for Kubernetes 2.5 for RHEL 8 rhacm2/acm-cluster-proxy-rhel8, rhacm2/acm-governance-policy-addon-controller-rhel8, rhacm2/acm-grafana-rhel8 +47
  • RHSA-2022:4914 Released 2022-06-06 · Red Hat rating Moderate
    rh-nodejs12-nodejs security, bug fix, and enhancement update
    • Red Hat Software Collections for RHEL Workstation(v. 7) rh-nodejs12-nodejs-12.22.12-2.el7, rh-nodejs12-nodejs-devel-12.22.12-2.el7, rh-nodejs12-nodejs-docs-12.22.12-2.el7 +1
    • Red Hat Software Collections for RHEL(v. 7) rh-nodejs12-nodejs-12.22.12-2.el7, rh-nodejs12-nodejs-devel-12.22.12-2.el7, rh-nodejs12-nodejs-docs-12.22.12-2.el7 +1
Show 5 more Red Hat advisories
  • RHSA-2022:0735 Released 2022-03-03 · Red Hat rating Important
    Red Hat Advanced Cluster Management 2.4.2 security updates and bug fixes
    • Red Hat Advanced Cluster Management for Kubernetes 2.4 for RHEL 8 rhacm2/acm-grafana-rhel8, rhacm2/acm-must-gather-rhel8, rhacm2/acm-operator-bundle +47
  • RHSA-2022:0350 Released 2022-02-01 · Red Hat rating Moderate
    nodejs:14 security, bug fix, and enhancement update
    • Red Hat Enterprise Linux AppStream (v. 8) nodejs-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.aarch64::nodejs:14, nodejs-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.ppc64le::nodejs:14, nodejs-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.s390x::nodejs:14 +19
  • RHSA-2022:0246 Released 2022-01-25 · Red Hat rating Moderate
    nodejs:14 security, bug fix, and enhancement update
    • Red Hat Enterprise Linux AppStream EUS (v.8.4) nodejs-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.aarch64::nodejs:14, nodejs-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.ppc64le::nodejs:14, nodejs-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.s390x::nodejs:14 +19
  • RHSA-2022:0041 Released 2022-01-06 · Red Hat rating Moderate
    rh-nodejs14-nodejs and rh-nodejs14-nodejs-nodemon security update
    • Red Hat Software Collections for RHEL Workstation(v. 7) rh-nodejs14-nodejs-14.18.2-1.el7, rh-nodejs14-nodejs-devel-14.18.2-1.el7, rh-nodejs14-nodejs-docs-14.18.2-1.el7 +2
    • Red Hat Software Collections for RHEL(v. 7) rh-nodejs14-nodejs-14.18.2-1.el7, rh-nodejs14-nodejs-devel-14.18.2-1.el7, rh-nodejs14-nodejs-docs-14.18.2-1.el7 +2
  • RHSA-2021:5171 Released 2021-12-16 · Red Hat rating Moderate
    nodejs:16 security, bug fix, and enhancement update
    • Red Hat Enterprise Linux AppStream (v. 8) nodejs-1:16.13.1-3.module+el8.5.0+13548+45d748af.aarch64::nodejs:16, nodejs-1:16.13.1-3.module+el8.5.0+13548+45d748af.ppc64le::nodejs:16, nodejs-1:16.13.1-3.module+el8.5.0+13548+45d748af.s390x::nodejs:16 +19

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
Migration Toolkit for VirtualizationAffectedNo fix planned: Will not fix
OpenShift Service Mesh 2.0AffectedNo fix yet
OpenShift Service Mesh 2.1AffectedNo fix yet
Red Hat Advanced Cluster Management for Kubernetes 2AffectedNo fix yet
Red Hat OpenShift Container Platform 4AffectedNo fix planned: Will not fix
Red Hat OpenShift distributed tracing 2AffectedNo fix yet
Red Hat Openshift Data Foundation 4AffectedNo fix planned: Will not fix
Red Hat Quay 3AffectedNo fix planned: Will not fix
Red Hat Enterprise Linux AppStream (v. 8)Fixed RHSA-2021:5171, RHSA-2022:0350
Red Hat Enterprise Linux AppStream E4S (v. 8.1)Fixed—
Red Hat Enterprise Linux AppStream EUS (v. 8.2)Fixed—
Red Hat Enterprise Linux AppStream EUS (v.8.4)Fixed RHSA-2022:0246
Red Hat Software Collections for RHEL Workstation(v. 7)Fixed RHSA-2022:0041, RHSA-2022:4914
Red Hat Software Collections for RHEL(v. 7)Fixed RHSA-2022:0041, RHSA-2022:4914
Not affected: 4 products
  • Logging Subsystem for Red Hat OpenShift
  • Red Hat Advanced Cluster Management for Kubernetes 2
  • Red Hat Enterprise Linux 9
  • Red Hat OpenShift Application Runtimes

Timeline

  1. 2026-10-02 Threatist record created from CVE-2021-3918
  2. 2026-10-03 Alias added: GHSA-896r-f27r-55mw
  3. 2026-10-21 EPSS moved to the 90th–95th percentile

References

Exploit 1

Patch 1

Advisory 2

Other 4

  • TI-2023-28522 Conversion of property names to strings can trigger infinite recursion CVSS 3.1MEDIUM 6.8

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences