Prototype pollution in com.graphhopper:graphhopper-web-bundle
Priority LOW 27CWE-1321Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- Required
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- Low · None · Low
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub.
Summary
This affects the package com.graphhopper:graphhopper-web-bundle before 3.2, from 4.0-pre1 and before 4.0. The URL parser could be tricked into adding or modifying properties of Object.prototype using a constructor or __proto__ payload.
Why it matters now
EPSS 0.01401 72nd percentileScored 2026-11-07
Fix Fixed com.graphhopper:graphhopper-web-bundle: 3.2, 4.0com.graphhopper:graphhopper-web-bundle (Maven): 3.2
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | com.graphhopper:graphhopper-web-bundle | before 3.2; 4.0-pre1 and later; before 4.0 | 3.2, 4.0 | Patch available | CNA |
| — | com.graphhopper:graphhopper-web-bundle (Maven) | before 3.2 | 3.2 | Patch available | GHSA-qhxh-9hhx-6p7v |
- com.graphhopper:graphhopper-web-bundle Vendor— Affected before 3.2; 4.0-pre1 and later; before 4.0 Fixed in 3.2, 4.0 Patch available CNA
- com.graphhopper:graphhopper-web-bundle (Maven) Vendor— Affected before 3.2 Fixed in 3.2 Patch available GHSA-qhxh-9hhx-6p7v
CPE configurations NVD · 3
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:graphhopper:graphhopper:*:*:*:*:*:*:*:* | before 3.2 | Vulnerable | graphhopper |
| cpe:2.3:a:graphhopper:graphhopper:4.0:pre1:*:*:*:*:*:* | 4.0 pre1 | Vulnerable | graphhopper |
| cpe:2.3:a:graphhopper:graphhopper:4.0:pre2:*:*:*:*:*:* | 4.0 pre2 | Vulnerable | graphhopper |
- cpe:2.3:a:graphhopper:graphhopper:*:*:*:*:*:*:*:* Versions before 3.2 Vulnerable ·graphhopper
- cpe:2.3:a:graphhopper:graphhopper:4.0:pre1:*:*:*:*:*:* Versions 4.0 pre1 Vulnerable ·graphhopper
- cpe:2.3:a:graphhopper:graphhopper:4.0:pre2:*:*:*:*:*:* Versions 4.0 pre2 Vulnerable ·graphhopper
Remediation
- Fix · CNA com.graphhopper:graphhopper-web-bundle Fixed in 3.2, 4.0
- Fix · GHSA-qhxh-9hhx-6p7v com.graphhopper:graphhopper-web-bundle (Maven) Fixed in 3.2 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2021-23408
- 2026-10-03 Alias added: GHSA-qhxh-9hhx-6p7v
References
More Graphhopper vulnerabilities
- TI-2021-10214 Navigate endpoint is vulnerable to regex injection that may lead to Denial of Service. CVSS 3.1MEDIUM 6.5
Sources
- CVE-2021-23408 · CVE Program
- CVE-2021-23408 · NVD
- FIRST EPSS
- GHSA-qhxh-9hhx-6p7v · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences