{"id":"CVE-2021-28860","aliases":["EUVD-2022-1163","GHSA-79jw-6wg7-r9g4","GHSA-r5cq-9537-9rpf"],"status":"published","title":"Prototype Pollution in mixme","description":"In Node.js mixme, prior to v0.5.1, an attacker can add or alter properties of an object via '__proto__' through the mutate() and merge() functions. The polluted attribute will be directly assigned to every object in the program. This will put the availability of the program at risk causing a potential denial of service (DoS).","severity":{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H","level":"critical","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-10","score":0.01843,"percentile":0.79193,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-1321","CWE-913"],"published":"2021-05-03T11:48:33Z","modified":"2026-10-20T10:54:36Z","fixes":[{"ecosystem":"npm","package":"mixme","fixed_in":["0.5.1"],"sources":["ghsa"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"mixme","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.5.1"}]}]},{"source":"osv","ecosystem":"npm","package":"mixme","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"0.5.1"}]}],"bundled":2},{"source":"osv","ecosystem":"npm","package":"mixme","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"0.5.1"}]}],"bundled":2}],"products":[{"vendor":"adaltas","product":"mixme"}],"references":[{"url":"https://www.npmjs.com/~david","tags":["x_refsource_MISC","x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://github.com/adaltas/node-mixme/issues/1","tags":["x_refsource_MISC","x_transferred","Issue Tracking","Third Party Advisory","report","web"]},{"url":"https://github.com/adaltas/node-mixme/commit/cfd5fbfc32368bcf7e06d1c5985ea60e34cd4028","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory","fix","web"]},{"url":"https://github.com/adaltas/node-mixme/security/advisories/GHSA-79jw-6wg7-r9g4","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory","fix","web"]},{"url":"https://security.netapp.com/advisory/ntap-20210618-0005/","tags":["x_refsource_CONFIRM","x_transferred","Third Party Advisory","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-28860","tags":["advisory"]},{"url":"http://nodejs.com","tags":["web"]},{"url":"https://github.com/advisories/GHSA-r5cq-9537-9rpf"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-29491","tags":["advisory"]},{"url":"https://security.netapp.com/advisory/ntap-20210622-0002","tags":["web"]},{"url":"https://github.com/adaltas/node-mixme","tags":["package"]},{"url":"https://security.netapp.com/advisory/ntap-20210618-0005","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2021-28860","description":"In Node.js mixme, prior to v0.5.1, an attacker can add or alter properties of an object via '__proto__' through the mutate() and merge() functions. The polluted attribute will be directly assigned to every object in the program. This will put the availability of the program at risk causing a potential denial of service (DoS).","status":"published","published":"2021-05-03T11:48:33Z","modified":"2026-07-09T00:12:54.018Z","updated_at":"2026-11-02T14:33:09.175141Z"}],"euvd":[{"id":"EUVD-2022-1163","description":"In Node.js mixme, prior to v0.5.1, an attacker can add or alter properties of an object via '__proto__' through the mutate() and merge() functions. The polluted attribute will be directly assigned to every object in the program. This will put the availability of the program at risk causing a potential denial of service (DoS).","status":"published","published":"2021-05-03T11:48:33Z","modified":"2026-07-09T00:12:54Z","updated_at":"2026-11-02T18:20:09.112703Z"}],"ghsa":[{"id":"GHSA-r5cq-9537-9rpf","title":"Prototype Pollution in mixme","description":"Node.js mixme 0.5.0, an attacker can add or alter properties of an object via '__proto__' through the mutate() and merge() functions. The polluted attribute will be directly assigned to every object in the program. This will put the availability of the program at risk causing a potential denial of service (DoS).","status":"published","published":"2022-02-10T23:52:01Z","modified":"2023-02-01T05:06:01Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H","level":"critical"}],"cwes":["CWE-1321"],"updated_at":"2026-11-02T14:36:36.66596Z"}],"nvd":[{"id":"CVE-2021-28860","description":"In Node.js mixme, prior to v0.5.1, an attacker can add or alter properties of an object via '__proto__' through the mutate() and merge() functions. The polluted attribute will be directly assigned to every object in the program. This will put the availability of the program at risk causing a potential denial of service (DoS).","status":"published","published":"2021-05-03T12:15:07.467Z","modified":"2026-07-09T01:16:49.603Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H","level":"critical","assessor":"primary"},{"version":"2.0","score":6.4,"vector":"AV:N/AC:L/Au:N/C:N/I:P/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-1321"],"updated_at":"2026-11-02T14:06:52.81233Z"}],"osv":[{"id":"CVE-2021-28860","description":"In Node.js mixme, prior to v0.5.1, an attacker can add or alter properties of an object via '__proto__' through the mutate() and merge() functions. The polluted attribute will be directly assigned to every object in the program. This will put the availability of the program at risk causing a potential denial of service (DoS).","status":"published","published":"2021-05-03T12:15:07.467Z","modified":"2026-10-20T10:54:36.764963227Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:44:19.129331Z"},{"id":"GHSA-79jw-6wg7-r9g4","title":"Use of Potentially Dangerous Function in mixme","description":"### Impact\n\nIn Node.js mixme v0.5.0, an attacker can add or alter properties of an object via 'proto' through the mutate() and merge() functions. The polluted attribute will be directly assigned to every object in the program. This will put the availability of the program at risk causing a potential denial of service (DoS).\n\n### Patches\nThe problem is corrected starting with version 0.5.1.\n\n### References\nIssue: https://github.com/adaltas/node-mixme/issues/1\nCommit: https://github.com/adaltas/node-mixme/commit/cfd5fbfc32368bcf7e06d1c5985ea60e34cd4028\n\n","status":"published","published":"2021-05-06T15:45:39Z","modified":"2026-09-10T03:49:04.733044773Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H","level":"high"}],"cwes":["CWE-913"],"updated_at":"2026-11-02T15:46:41.002603Z"},{"id":"GHSA-r5cq-9537-9rpf","title":"Prototype Pollution in mixme","description":"Node.js mixme 0.5.0, an attacker can add or alter properties of an object via '__proto__' through the mutate() and merge() functions. The polluted attribute will be directly assigned to every object in the program. This will put the availability of the program at risk causing a potential denial of service (DoS).","status":"published","published":"2022-02-10T23:52:01Z","modified":"2026-09-10T03:49:12.874649745Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H","level":"critical"}],"cwes":["CWE-1321"],"updated_at":"2026-11-02T15:46:55.480549Z"}]}}