Read the docs
TI-2021-06126 Aliases CVE-2021-23434GHSA-v39p-96qg-c8rf

Prototype pollution in object-path

Priority MEDIUM 41CWE-843Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
Low · Low · High
Fix status
Partial Red Hat: 6 without a fix

Attack profile from CVSS 3.1 · NVD. Fix status from CNA, GitHub and Red Hat.

Summary

This affects the package object-path before 0.11.6. A type confusion vulnerability can lead to a bypass of CVE-2020-15256 when the path components used in the path parameter are arrays. In particular, the condition currentPath === '__proto__' returns false if currentPath is ['__proto__']. This is because the === operator returns always false when the type of the operands is different.

Why it matters now

EPSS 0.01902 79th percentileScored 2026-11-07
Fix Partial object-path: 0.11.6object-path (npm): 0.11.6Red Hat: 2 advisoriesRed Hat: 6 without a fix

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
—object-pathbefore 0.11.60.11.6Patch availableCNA
—object-path (npm)before 0.11.60.11.6Patch availableGHSA-v39p-96qg-c8rf
  • object-path Vendor— Affected before 0.11.6 Fixed in 0.11.6 Patch available CNA
  • object-path (npm) Vendor— Affected before 0.11.6 Fixed in 0.11.6 Patch available GHSA-v39p-96qg-c8rf

CPE configurations NVD · 2

CPEVersionsRoleVendor
cpe:2.3:a:object-path_project:object-path:*:*:*:*:*:node.js:*:*before 0.11.6VulnerableObject-path Project
cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*10.0VulnerableDebian
  • cpe:2.3:a:object-path_project:object-path:*:*:*:*:*:node.js:*:* Versions before 0.11.6 Vulnerable ·Object-path Project
  • cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:* Versions 10.0 Vulnerable ·Debian

Remediation

  • Fix · CNA object-path Fixed in 0.11.6
  • Fix · GHSA-v39p-96qg-c8rf object-path (npm) Fixed in 0.11.6 Advisory →

Red Hat 2 advisories

  • RHSA-2022:0856 Released 2022-03-14 · Red Hat rating Moderate
    Red Hat Advanced Cluster Management 2.2.11 security updates and bug fixes
    • Red Hat Advanced Cluster Management for Kubernetes 2.2 for RHEL 7 rhacm2/management-ingress-rhel7, rhacm2/memcached-exporter-rhel7, rhacm2/search-aggregator-rhel7 +1
    • Red Hat Advanced Cluster Management for Kubernetes 2.2 for RHEL 8 rhacm2/acm-must-gather-rhel8, rhacm2/acm-operator-bundle, rhacm2/acmesolver-rhel8 +47
  • RHSA-2021:3873 Released 2021-10-14 · Red Hat rating Important
    Red Hat Advanced Cluster Management 2.2.9 security, bug, and container updates
    • Red Hat Advanced Cluster Management for Kubernetes 2.2 for RHEL 7 rhacm2/management-ingress-rhel7, rhacm2/memcached-exporter-rhel7, rhacm2/search-aggregator-rhel7 +1
    • Red Hat Advanced Cluster Management for Kubernetes 2.2 for RHEL 8 rhacm2/acm-must-gather-rhel8, rhacm2/acm-operator-bundle, rhacm2/acmesolver-rhel8 +47

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
OpenShift Service Mesh 1AffectedNo fix planned: Out of support scope
OpenShift Service Mesh 2.0AffectedNo fix yet
Red Hat Advanced Cluster Management for Kubernetes 2AffectedNo fix yet
Red Hat JBoss Data Grid 7AffectedNo fix planned: Out of support scope
Red Hat OpenShift Container Platform 4AffectedNo fix planned: Out of support scope
Service Telemetry Framework 1.2 for RHEL 8AffectedNo fix planned: Will not fix

Timeline

  1. 2026-10-02 Threatist record created from CVE-2021-23434
  2. 2026-10-03 Alias added: GHSA-v39p-96qg-c8rf

References

Patch 1

Advisory 2

Other 3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences