TI-2021-06167 Aliases CVE-2021-23574 GHSA-c6h4-gc3f-hgjq

Prototype pollution in js-data

MEDIUM 46CWE-1321Published 2021-12-24 · Updated 2024-09-16

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Impact type: —
Confidentiality · integrity · availability: High · High · High
Fix status: No fix listed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub.

Summary

All versions of package js-data are vulnerable to Prototype Pollution via the deepFillIn and the set functions. This is an incomplete fix of [CVE-2020-28442](https://snyk.io/vuln/SNYK-JS-JSDATA-1023655).

Why it matters now

EPSS 0.02168 82nd percentileScored 2026-11-07

Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
—	js-data	all versions	—	No fix listed	CNA
—	js-data (npm)	up to 3.0.10	—	No fix listed	GHSA-c6h4-gc3f-hgjq

js-data Vendor— Affected all versions Fixed in — No fix listed CNA
js-data (npm) Vendor— Affected up to 3.0.10 Fixed in — No fix listed GHSA-c6h4-gc3f-hgjq

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:js-data:js-data::::::node.js::*	before 3.0.11	Vulnerable	Js-data

cpe:2.3:a:js-data:js-data:*:*:*:*:*:node.js:*:* Versions before 3.0.11 Vulnerable ·Js-data

Remediation

No fixed version listed by the sources yet.

Timeline

2026-10-02 Threatist record created from CVE-2021-23574
2026-10-03 Alias added: GHSA-c6h4-gc3f-hgjq

References

Patch 2

Advisory 2

Other 1

https://github.com/js-data/js-data

TI-2020-17259 Prototype pollution in js-data CVSS 3.1CRITICAL 9.8

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences