{"id":"CVE-2021-29491","aliases":["EUVD-2021-0994","GHSA-79jw-6wg7-r9g4","GHSA-r5cq-9537-9rpf"],"status":"rejected","title":"Use of Potentially Dangerous Function in mixme","description":"DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2021-28860. Reason: This candidate is a reservation duplicate of CVE-2021-28860. Notes: All CVE users should reference CVE-2021-28860 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage","severity":{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H","level":"high","from":"ghsa"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-1321","CWE-913"],"published":"2021-05-03T12:15:07.467Z","modified":"2026-10-20T10:54:36Z","fixes":[{"ecosystem":"npm","package":"mixme","fixed_in":["0.5.1"],"sources":["ghsa"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"mixme","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.5.1"}]}]},{"source":"osv","ecosystem":"npm","package":"mixme","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"0.5.1"}]}],"bundled":2},{"source":"osv","ecosystem":"npm","package":"mixme","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"0.5.1"}]}],"bundled":2}],"references":[{"url":"https://github.com/adaltas/node-mixme/security/advisories/GHSA-79jw-6wg7-r9g4","tags":["fix","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-29491","tags":["advisory"]},{"url":"https://security.netapp.com/advisory/ntap-20210622-0002/"},{"url":"https://github.com/advisories/GHSA-79jw-6wg7-r9g4"},{"url":"https://security.netapp.com/advisory/ntap-20210618-0005/","tags":["advisory"]},{"url":"https://www.npmjs.com/~david","tags":["advisory","web"]},{"url":"https://github.com/adaltas/node-mixme/issues/1","tags":["report","web"]},{"url":"https://github.com/adaltas/node-mixme/commit/cfd5fbfc32368bcf7e06d1c5985ea60e34cd4028","tags":["fix","web"]},{"url":"https://security.netapp.com/advisory/ntap-20210622-0002","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-28860","tags":["advisory"]},{"url":"https://github.com/adaltas/node-mixme","tags":["package"]},{"url":"https://security.netapp.com/advisory/ntap-20210618-0005","tags":["web"]},{"url":"http://nodejs.com","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2021-29491","description":"DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2021-28860. Reason: This candidate is a reservation duplicate of CVE-2021-28860. Notes: All CVE users should reference CVE-2021-28860 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage","status":"rejected","published":"2021-05-06T12:51:37Z","modified":"2022-03-14T20:10:08Z","updated_at":"2026-11-02T14:33:06.658806Z"}],"euvd":[{"id":"EUVD-2021-0994","description":"DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2021-28860. Reason: This candidate is a reservation duplicate of CVE-2021-28860. Notes: All CVE users should reference CVE-2021-28860 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage","status":"published","published":"2021-05-06T12:51:37Z","modified":"2022-03-14T20:10:08Z","updated_at":"2026-11-03T03:51:09.389822Z"}],"ghsa":[{"id":"GHSA-79jw-6wg7-r9g4","title":"Use of Potentially Dangerous Function in mixme","description":"### Impact\n\nIn Node.js mixme v0.5.0, an attacker can add or alter properties of an object via 'proto' through the mutate() and merge() functions. The polluted attribute will be directly assigned to every object in the program. This will put the availability of the program at risk causing a potential denial of service (DoS).\n\n### Patches\nThe problem is corrected starting with version 0.5.1.\n\n### References\nIssue: https://github.com/adaltas/node-mixme/issues/1\nCommit: https://github.com/adaltas/node-mixme/commit/cfd5fbfc32368bcf7e06d1c5985ea60e34cd4028\n\n","status":"published","published":"2021-05-06T15:45:39Z","modified":"2023-02-01T05:05:34Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H","level":"high"}],"cwes":["CWE-913"],"updated_at":"2026-11-02T14:36:34.917834Z"}],"nvd":[{"id":"CVE-2021-29491","description":"Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2021-28860. Reason: This candidate is a reservation duplicate of CVE-2021-28860. Notes: All CVE users should reference CVE-2021-28860 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage","status":"rejected","published":"2021-05-06T13:15:12.533Z","modified":"2023-11-07T03:32:38.597Z","updated_at":"2026-11-02T14:06:52.81233Z"}],"osv":[{"id":"CVE-2021-28860","description":"In Node.js mixme, prior to v0.5.1, an attacker can add or alter properties of an object via '__proto__' through the mutate() and merge() functions. The polluted attribute will be directly assigned to every object in the program. This will put the availability of the program at risk causing a potential denial of service (DoS).","status":"published","published":"2021-05-03T12:15:07.467Z","modified":"2026-10-20T10:54:36.764963227Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:44:19.129331Z"},{"id":"GHSA-79jw-6wg7-r9g4","title":"Use of Potentially Dangerous Function in mixme","description":"### Impact\n\nIn Node.js mixme v0.5.0, an attacker can add or alter properties of an object via 'proto' through the mutate() and merge() functions. The polluted attribute will be directly assigned to every object in the program. This will put the availability of the program at risk causing a potential denial of service (DoS).\n\n### Patches\nThe problem is corrected starting with version 0.5.1.\n\n### References\nIssue: https://github.com/adaltas/node-mixme/issues/1\nCommit: https://github.com/adaltas/node-mixme/commit/cfd5fbfc32368bcf7e06d1c5985ea60e34cd4028\n\n","status":"published","published":"2021-05-06T15:45:39Z","modified":"2026-09-10T03:49:04.733044773Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H","level":"high"}],"cwes":["CWE-913"],"updated_at":"2026-11-02T15:46:41.002603Z"},{"id":"GHSA-r5cq-9537-9rpf","title":"Prototype Pollution in mixme","description":"Node.js mixme 0.5.0, an attacker can add or alter properties of an object via '__proto__' through the mutate() and merge() functions. The polluted attribute will be directly assigned to every object in the program. This will put the availability of the program at risk causing a potential denial of service (DoS).","status":"published","published":"2022-02-10T23:52:01Z","modified":"2026-09-10T03:49:12.874649745Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H","level":"critical"}],"cwes":["CWE-1321"],"updated_at":"2026-11-02T15:46:55.480549Z"}]}}