Read the docs
TI-2021-04404 Aliases CVE-2021-21304GHSA-rrqm-p222-8ph2

Prototype Pollution in Dynamoose

Priority MEDIUM 46CWE-1321Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Tampering
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub. Impact type from CWE-915.

Summary

Dynamoose is an open-source modeling tool for Amazon's DynamoDB. In Dynamoose from version 2.0.0 and before version 2.7.0 there was a prototype pollution vulnerability in the internal utility method "lib/utils/object/set.ts". This method is used throughout the codebase for various operations throughout Dynamoose. We have not seen any evidence of this vulnerability being exploited. There is no evidence this vulnerability impacts versions 1.x.x since the vulnerable method was added as part of the v2 rewrite. This vulnerability also impacts v2.x.x beta/alpha versions. Version 2.7.0 includes a patch for this vulnerability.

Why it matters now

EPSS 0.01917 79th percentileScored 2026-11-07
Fix Fixed dynamoose (dynamoose): 2.7.0dynamoose (npm): 2.7.0

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
dynamoosedynamoose2.0.0 to before 2.7.02.7.0Patch availableCNA
—dynamoose (npm)2.0.0 to before 2.7.02.7.0Patch availableGHSA-rrqm-p222-8ph2
  • dynamoose Vendordynamoose Affected 2.0.0 to before 2.7.0 Fixed in 2.7.0 Patch available CNA
  • dynamoose (npm) Vendor— Affected 2.0.0 to before 2.7.0 Fixed in 2.7.0 Patch available GHSA-rrqm-p222-8ph2

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:dynamoosejs:dynamoose:*:*:*:*:*:node.js:*:*2.0.0 to before 2.7.0VulnerableDynamoosejs
  • cpe:2.3:a:dynamoosejs:dynamoose:*:*:*:*:*:node.js:*:* Versions 2.0.0 to before 2.7.0 Vulnerable ·Dynamoosejs

Remediation

  • Fix · CNA dynamoose (dynamoose) Fixed in 2.7.0
  • Fix · GHSA-rrqm-p222-8ph2 dynamoose (npm) Fixed in 2.7.0 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2021-21304
  2. 2026-10-03 Alias added: GHSA-rrqm-p222-8ph2

References

Patch 2

Advisory 3

Other 1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences