Read the docs
TI-2021-19169 Aliases CVE-2021-43138GHSA-fwr7-v2mv-hh25

In Async before 2.6.4 and 3.x before 3.2.2, a malicious user can obtain privileges via…

Priority MEDIUM 40CWE-1321Published · Updated

Key facts

Attack vector
Local
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
High · High · High
Fix status
Partial Red Hat: 2 fixed, 23 without a fix

Attack profile from CVSS 3.1 · NVD. Fix status from CNA, GitHub and Red Hat.

Summary

In Async before 2.6.4 and 3.x before 3.2.2, a malicious user can obtain privileges via the mapValues() method, aka lib/internal/iterator.js createObjectIterator prototype pollution.

Why it matters now

EPSS 0.03346 88th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Partial async (npm): 3.2.2, 2.6.4Red Hat: 2 advisoriesRed Hat: 2 fixed, 23 without a fix

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
—async (npm)3.0.0 to before 3.2.23.2.2Patch availableGHSA-fwr7-v2mv-hh25
—async (npm)2.0.0 to before 2.6.42.6.4Patch availableGHSA-fwr7-v2mv-hh25
  • — Vendor— Affected all versions Fixed in — No fix listed CNA
  • async (npm) Vendor— Affected 3.0.0 to before 3.2.2 Fixed in 3.2.2 Patch available GHSA-fwr7-v2mv-hh25
  • async (npm) Vendor— Affected 2.0.0 to before 2.6.4 Fixed in 2.6.4 Patch available GHSA-fwr7-v2mv-hh25

CPE configurations NVD · 3

CPEVersionsRoleVendor
cpe:2.3:a:async_project:async:*:*:*:*:*:*:*:*before 2.6.4; 3.0.0 to before 3.2.2VulnerableAsync Project
cpe:2.3:o:fedoraproject:fedora:36:*:*:*:*:*:*:*36VulnerableFedoraproject
cpe:2.3:o:fedoraproject:fedora:37:*:*:*:*:*:*:*37VulnerableFedoraproject
  • cpe:2.3:a:async_project:async:*:*:*:*:*:*:*:* Versions before 2.6.4; 3.0.0 to before 3.2.2 Vulnerable ·Async Project
  • cpe:2.3:o:fedoraproject:fedora:36:*:*:*:*:*:*:* Versions 36 Vulnerable ·Fedoraproject
  • cpe:2.3:o:fedoraproject:fedora:37:*:*:*:*:*:*:* Versions 37 Vulnerable ·Fedoraproject

Remediation

  • Fix · GHSA-fwr7-v2mv-hh25 async (npm) Fixed in 3.2.2 Advisory →
  • Fix · GHSA-fwr7-v2mv-hh25 async (npm) Fixed in 2.6.4 Advisory →

Red Hat 2 advisories

  • RHSA-2023:3645 Released 2023-06-15 · Red Hat rating Moderate
    Red Hat OpenShift Service Mesh 2.2.7 security update
    • RHOSSM 2.2 for RHEL 8 openshift-service-mesh/prometheus-rhel8
  • RHSA-2023:0693 Released 2023-02-09 · Red Hat rating Moderate
    Migration Toolkit for Containers (MTC) 1.7.7 security and bug fix update
    • 8Base-RHMTC-1.7 rhmtc/openshift-migration-controller-rhel8, rhmtc/openshift-migration-must-gather-rhel8, rhmtc/openshift-migration-openvpn-rhel8 +8

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Migration Toolkit for VirtualizationAffectedNo fix yet: Fix deferred
OpenShift Developer Tools and ServicesAffectedNo fix planned: Will not fix
OpenShift PipelinesAffectedNo fix planned: Will not fix
OpenShift Service Mesh 2AffectedNo fix planned: Will not fix
OpenShift Service Mesh 2.0AffectedNo fix yet
OpenShift Service Mesh 2.1AffectedNo fix planned: Will not fix
Red Hat Advanced Cluster Management for Kubernetes 2AffectedNo fix planned: Out of support scope
Red Hat Ceph Storage 4AffectedNo fix planned: Will not fix
Red Hat Decision Manager 7AffectedNo fix planned: Out of support scope
Red Hat Enterprise Linux 6AffectedNo fix planned: Out of support scope
Red Hat Enterprise Linux 7AffectedNo fix planned: Out of support scope
Red Hat Enterprise Linux 8AffectedNo fix planned: Will not fix
Red Hat Enterprise Linux 9AffectedNo fix planned: Will not fix
Red Hat Fuse 7AffectedNo fix planned: Will not fix
Red Hat Integration Service RegistryAffectedNo fix planned: Out of support scope
Red Hat JBoss Data Grid 7AffectedNo fix planned: Out of support scope
Red Hat OpenShift Container Platform 3.11AffectedNo fix planned: Will not fix
Red Hat OpenShift GitOpsAffectedNo fix planned: Will not fix
Red Hat OpenShift distributed tracing 2AffectedNo fix planned: Will not fix
Red Hat Openshift Container Storage 4AffectedNo fix yet
Red Hat Openshift Data Foundation 4AffectedNo fix yet
Red Hat Process Automation 7AffectedNo fix planned: Out of support scope
Red Hat Quay 3AffectedNo fix yet
8Base-RHMTC-1.7Fixed RHSA-2023:0693
RHOSSM 2.2 for RHEL 8Fixed RHSA-2023:3645
Not affected: 16 products
  • 8Base-RHMTC-1.7
  • Logging Subsystem for Red Hat OpenShift
  • RHOSSM 2.2 for RHEL 8
  • Red Hat A-MQ Online
  • Red Hat Advanced Cluster Management for Kubernetes 2
  • Red Hat Ansible Automation Platform 2
  • Red Hat Data Grid 8
  • Red Hat Enterprise Linux 8
  • Red Hat Enterprise Linux 9
  • Red Hat Integration Camel K 1
  • Red Hat JBoss Enterprise Application Platform 7
  • Red Hat JBoss Enterprise Application Platform Expansion Pack
  • Red Hat OpenShift Container Platform 4
  • Red Hat OpenShift Dev Spaces
  • Red Hat OpenShift distributed tracing 2
  • Red Hat build of Apicurio Registry 2

Timeline

  1. 2026-10-02 Threatist record created from CVE-2021-43138
  2. 2026-10-03 Alias added: GHSA-fwr7-v2mv-hh25

References

Exploit 1

Patch 3

Advisory 6

Other 9

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences