CVE-2021-23406

Remote Code Execution (RCE)

8.1 HighFix available

This affects the package pac-resolver before 5.0.0. This can occur when used with untrusted input, due to unsafe PAC file handling. NOTE: The fix for this vulnerability is applied in the node-degenerator library, a dependency written by the same maintainer.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: High
Privileges needed: None
User interaction: None

What an attacker can affect

Confidentiality: High
Integrity: High
Availability: High

Exploit likelihood

2.94%Up 1.7 points since Aug 24, 2021

What each source reports

CVE List Score used 8.1

Remote Code Execution (RCE)

Record: CVE-2021-23406
CVSS 3.1: 8.1 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P
Updated: 2026-11-02

EUVDEUVD-2021-2025 8.1

Record: EUVD-2021-2025
CVSS 3.1: 8.1 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P
Updated: 2026-11-03

GitHub AdvisoriesGHSA-9j49-mfvp-vmhm 8.1

Code Injection in pac-resolver

Record: GHSA-9j49-mfvp-vmhm
CVSS 3.1: 8.1 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness: CWE-94
Updated: 2026-11-02

NVD 8.1

Record: CVE-2021-23406
CVSS 3.1: 8.1 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS 2.0: 7.5 HighAV:N/AC:L/Au:N/C:P/I:P/A:P
Updated: 2026-11-02

OSV 9.8

Record: CVE-2021-23406
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVGHSA-9j49-mfvp-vmhm 8.1

Code Injection in pac-resolver

Record: GHSA-9j49-mfvp-vmhm
CVSS 3.1: 8.1 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness: CWE-94
Updated: 2026-11-02

OSVROOT-APP-NPM-CVE-2021-23406 9.8

CVE-2021-23406 in pac-resolver - Patched by Root

Root has patched CVE-2021-23406 in the pac-resolver package for Root:npm. Multiple fixed versions available.

Record: ROOT-APP-NPM-CVE-2021-23406
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-06

OSVCLSA-2026-1790104586 No score

TuxCare security update for pac-resolver (1 CVE)

TuxCare rebuilt pac-resolver to address 1 CVE. Fixed in 4.2.0-tuxcare.1.

Record: CLSA-2026-1790104586
Updated: 2026-11-02

Affected products

pac-resolver project pac-resolver

Affected packages

Affected packages
Package	Affected	Fixed
`pac-resolver` npm	before 5.0.0	5.0.0
`degenerator` npm	before 3.0.1	3.0.1
`pac-resolver` TuxCare:npm	4.2.0-tuxcare.0 up to 4.2.0-tuxcare.1, plus listed versions 4.2.0	4.2.0-tuxcare.1
`pac-resolver` Root:npm	before 3.0.0-aikido.1	3.0.0-aikido.1
`@rootio/pac-resolver` Root:npm	before 3.0.0-root.io.1	3.0.0-root.io.1

History

History
Recorded	Changed	Sources
Nov 6, 2026	affected, aliases, facts	OSV
Nov 3, 2026	aliases, published	EUVD
Nov 2, 2026	first indexed	CVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2021-23406 is a high vulnerability (CVSS 8.1) in Pac-resolver Project Pac-resolver, published August 24, 2021. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.94%, the 87th percentile. Fixed in pac-resolver 5.0.0.