chbrown rfc6902 pointer.ts prototype pollution
Priority MEDIUM 45CWE-74Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub.
Summary
A vulnerability classified as problematic has been found in chbrown rfc6902. This affects an unknown part of the file pointer.ts. The manipulation leads to improperly controlled modification of object prototype attributes ('prototype pollution'). The exploit has been disclosed to the public and may be used. The name of the patch is c006ce9faa43d31edb34924f1df7b79c137096cf. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-215883.
Why it matters now
EPSS 0.01352 71st percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed rfc6902 (npm): 5.0.0
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| chbrown | rfc6902 | all versions | — | No fix listed | CNA |
| — | rfc6902 (npm) | before 5.0.0 | 5.0.0 | Patch available | GHSA-p495-jxh2-wrfg |
- rfc6902 Vendorchbrown Affected all versions Fixed in — No fix listed CNA
- rfc6902 (npm) Vendor— Affected before 5.0.0 Fixed in 5.0.0 Patch available GHSA-p495-jxh2-wrfg
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:rfc6902_project:rfc6902:*:*:*:*:*:*:*:* | before 5.0.0 | Vulnerable | Rfc6902 Project |
- cpe:2.3:a:rfc6902_project:rfc6902:*:*:*:*:*:*:*:* Versions before 5.0.0 Vulnerable ·Rfc6902 Project
Remediation
- Fix · GHSA-p495-jxh2-wrfg rfc6902 (npm) Fixed in 5.0.0 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2021-4245
- 2026-10-03 Alias added: GHSA-p495-jxh2-wrfg
References
Sources
- CVE-2021-4245 · CVE Program
- CVE-2021-4245 · NVD
- FIRST EPSS
- GHSA-p495-jxh2-wrfg · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences