{"id":"CVE-2021-23807","aliases":["CLSA-2026-1772756022","CLSA-2026-1773706629","CLSA-2026-1773965925","EUVD-2021-2277","GHSA-282f-qqgm-c34q","OESA-2022-1755"],"status":"published","title":"Prototype Pollution","description":"This affects the package jsonpointer before 5.0.0. A type confusion vulnerability can lead to a bypass of a previous Prototype Pollution fix when the pointer components are arrays.","severity":{"version":"3.1","score":5.6,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.02752,"percentile":0.86409,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-1321","CWE-843"],"published":"2021-11-03T17:20:29Z","modified":"2026-10-20T10:54:32Z","fixes":[{"ecosystem":"npm","package":"jsonpointer","fixed_in":["5.0.0"],"sources":["ghsa","osv"]},{"ecosystem":"npm","package":"org.webjars.npm:json-pointer","fixed_in":["5.0.0"],"sources":["ghsa","osv"]},{"ecosystem":"TuxCare:npm","package":"jsonpointer","fixed_in":["2.0.0-tuxcare.1","1.1.0-tuxcare.1","4.1.0-tuxcare.2"],"sources":["osv"]},{"ecosystem":"openEuler:20.03-LTS-SP1","package":"nodejs-jsonpointer","fixed_in":["5.0.0-1.oe1"],"sources":["osv"]},{"ecosystem":"openEuler:20.03-LTS-SP3","package":"nodejs-jsonpointer","fixed_in":["5.0.0-1.oe1"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS","package":"nodejs-jsonpointer","fixed_in":["5.0.0-1.oe2203"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"jsonpointer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.0.0"}]}]},{"source":"ghsa","ecosystem":"npm","package":"org.webjars.npm:json-pointer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.0.0"}]}]},{"source":"osv","ecosystem":"TuxCare:npm","package":"jsonpointer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.0.0-tuxcare.0"},{"fixed":"2.0.0-tuxcare.1"}]}],"versions":["2.0.0"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"jsonpointer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.1.0-tuxcare.0"},{"fixed":"1.1.0-tuxcare.1"}]}],"versions":["1.1.0"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"jsonpointer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.0-tuxcare.0"},{"fixed":"4.1.0-tuxcare.2"}]}],"versions":["4.1.0","4.1.0-tuxcare.1"]},{"source":"osv","ecosystem":"npm","package":"jsonpointer","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"5.0.0"}]}]},{"source":"osv","ecosystem":"npm","package":"org.webjars.npm:json-pointer","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"5.0.0"}]}]},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP1","package":"nodejs-jsonpointer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.0.0-1.oe1"}]}]},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP3","package":"nodejs-jsonpointer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.0.0-1.oe1"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS","package":"nodejs-jsonpointer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.0.0-1.oe2203"}]}]}],"products":[{"vendor":"janl","product":"jsonpointer"}],"references":[{"url":"https://snyk.io/vuln/SNYK-JS-JSONPOINTER-1577288","tags":["x_refsource_MISC","x_transferred","Exploit","Mitigation","Patch","Third Party Advisory","VDB Entry","fix","web"]},{"url":"https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1910273","tags":["x_refsource_MISC","x_transferred","Exploit","Mitigation","Patch","Third Party Advisory","VDB Entry","fix","web"]},{"url":"https://github.com/janl/node-jsonpointer/pull/51","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory","fix","web"]},{"url":"https://github.com/janl/node-jsonpointer/commit/a0345f3550cd9c4d89f33b126390202b89510ad4","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory","fix","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-23807","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-282f-qqgm-c34q"},{"url":"https://github.com/janl/node-jsonpointer","tags":["package"]},{"url":"https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2022-1755","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2021-23807","title":"Prototype Pollution","description":"This affects the package jsonpointer before 5.0.0. A type confusion vulnerability can lead to a bypass of a previous Prototype Pollution fix when the pointer components are arrays.","status":"published","published":"2021-11-03T17:20:29.421Z","modified":"2024-09-16T23:25:55.568Z","cvss":[{"version":"3.1","score":5.6,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C","level":"medium","assessor":"cna"}],"updated_at":"2026-11-02T14:33:00.819444Z"}],"euvd":[{"id":"EUVD-2021-2277","description":"This affects the package jsonpointer before 5.0.0. A type confusion vulnerability can lead to a bypass of a previous Prototype Pollution fix when the pointer components are arrays.","status":"published","published":"2021-11-03T17:20:29Z","modified":"2024-09-16T23:25:55Z","cvss":[{"version":"3.1","score":5.6,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C","level":"medium"}],"updated_at":"2026-11-03T00:54:50.852699Z"}],"ghsa":[{"id":"GHSA-282f-qqgm-c34q","title":"Prototype Pollution in node-jsonpointer","description":"This affects the package `jsonpointer` before `5.0.0`. A type confusion vulnerability can lead to a bypass of a previous Prototype Pollution fix when the pointer components are arrays.","status":"published","published":"2021-11-08T17:44:45Z","modified":"2025-03-05T19:06:11Z","cvss":[{"version":"3.1","score":5.6,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L","level":"medium"}],"cwes":["CWE-843","CWE-1321"],"updated_at":"2026-11-02T14:38:34.185137Z"}],"nvd":[{"id":"CVE-2021-23807","description":"This affects the package jsonpointer before 5.0.0. A type confusion vulnerability can lead to a bypass of a previous Prototype Pollution fix when the pointer components are arrays.","status":"published","published":"2021-11-03T18:15:08.23Z","modified":"2026-06-17T03:38:53.393Z","cvss":[{"version":"3.1","score":5.6,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L","level":"medium","assessor":"secondary"},{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"},{"version":"2.0","score":7.5,"vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","level":"high","assessor":"primary"}],"cwes":["CWE-843"],"updated_at":"2026-11-02T14:07:00.549994Z"}],"osv":[{"id":"CVE-2021-23807","description":"This affects the package jsonpointer before 5.0.0. A type confusion vulnerability can lead to a bypass of a previous Prototype Pollution fix when the pointer components are arrays.","status":"published","published":"2021-11-03T18:15:08.23Z","modified":"2026-10-20T10:54:32.771188202Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:44:18.778776Z"},{"id":"GHSA-282f-qqgm-c34q","title":"Prototype Pollution in node-jsonpointer","description":"This affects the package `jsonpointer` before `5.0.0`. A type confusion vulnerability can lead to a bypass of a previous Prototype Pollution fix when the pointer components are arrays.","status":"published","published":"2021-11-08T17:44:45Z","modified":"2026-09-10T03:49:09.41650071Z","cvss":[{"version":"3.1","score":5.6,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L","level":"medium"}],"cwes":["CWE-1321","CWE-843"],"updated_at":"2026-11-02T15:46:33.956911Z"},{"id":"OESA-2022-1755","title":"nodejs-jsonpointer security update","description":"Simple JSON Addressing.\r\n\r\nSecurity Fix(es):\r\n\r\nThis affects the package jsonpointer before 5.0.0. A type confusion vulnerability can lead to a bypass of a previous Prototype Pollution fix when the pointer components are arrays.(CVE-2021-23807)","status":"published","published":"2022-07-21T11:05:01Z","modified":"2026-08-18T01:16:45.083513165Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:52:39.528805Z"},{"id":"CLSA-2026-1772756022","title":"TuxCare security update for jsonpointer (1 CVE)","description":"TuxCare rebuilt jsonpointer to address 1 CVE. Fixed in 2.0.0-tuxcare.1.","status":"published","published":"2026-08-04T14:52:10Z","modified":"2026-10-15T09:45:42.152062504Z","updated_at":"2026-11-02T15:43:43.249928Z"},{"id":"CLSA-2026-1773706629","title":"TuxCare security update for jsonpointer (1 CVE)","description":"TuxCare rebuilt jsonpointer to address 1 CVE. Fixed in 1.1.0-tuxcare.1.","status":"published","published":"2026-08-04T14:52:13Z","modified":"2026-10-15T09:47:47.086935402Z","updated_at":"2026-11-02T15:43:43.621843Z"},{"id":"CLSA-2026-1773965925","title":"TuxCare security update for jsonpointer (1 CVE)","description":"TuxCare rebuilt jsonpointer to address 1 CVE. Fixed in 4.1.0-tuxcare.2.","status":"published","published":"2026-08-04T14:52:13Z","modified":"2026-10-15T09:47:00.114479795Z","updated_at":"2026-11-02T15:43:43.621843Z"}]}}