Read the docs
TI-2021-06128 Aliases CVE-2021-23436GHSA-33f9-j839-rf8h

Prototype pollution in immer

Priority MEDIUM 46CWE-843Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Partial Red Hat: 1 fixed, 1 without a fix

Attack profile from CVSS 3.1 · NVD. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-843 and the CVSS impact.

Summary

This affects the package immer before 9.0.6. A type confusion vulnerability can lead to a bypass of CVE-2020-28477 when the user-provided keys used in the path parameter are arrays. In particular, this bypass is possible because the condition (p === "__proto__" || p === "constructor") in applyPatches_ returns false if p is ['__proto__'] (or ['constructor']). The === operator (strict equality operator) returns false if the operands have different type.

Why it matters now

EPSS 0.01795 78th percentileScored 2026-11-07
Fix Partial immer: 9.0.6immer (npm): 9.0.6Red Hat: 1 advisoryRed Hat: 1 fixed, 1 without a fix

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
—immerbefore 9.0.69.0.6Patch availableCNA
—immer (npm)7.0.0 to before 9.0.69.0.6Patch availableGHSA-33f9-j839-rf8h
  • immer Vendor— Affected before 9.0.6 Fixed in 9.0.6 Patch available CNA
  • immer (npm) Vendor— Affected 7.0.0 to before 9.0.6 Fixed in 9.0.6 Patch available GHSA-33f9-j839-rf8h

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:immer_project:immer:*:*:*:*:*:node.js:*:*before 9.0.6VulnerableImmer Project
  • cpe:2.3:a:immer_project:immer:*:*:*:*:*:node.js:*:* Versions before 9.0.6 Vulnerable ·Immer Project

Remediation

  • Fix · CNA immer Fixed in 9.0.6
  • Fix · GHSA-33f9-j839-rf8h immer (npm) Fixed in 9.0.6 Advisory →

Red Hat 1 advisory

  • RHSA-2022:6813 Released 2022-10-05 · Red Hat rating Important
    Red Hat Process Automation Manager 7.13.1 security update
    • RHPAM 7.13.1 async

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Process Automation 7AffectedNo fix planned: Out of support scope
RHPAM 7.13.1 asyncFixed RHSA-2022:6813
Not affected: 1 product
  • Red Hat Advanced Cluster Management for Kubernetes 2

Timeline

  1. 2026-10-02 Threatist record created from CVE-2021-23436
  2. 2026-10-03 Alias added: GHSA-33f9-j839-rf8h

References

Patch 1

Advisory 1

Other 1

  • TI-2021-02689 Prototype Pollution in immerjs/immer CVSS 3.1CRITICAL 9.8
  • TI-2020-17287 Prototype pollution in immer CVSS 3.1HIGH 7.5

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences