cve.bz

CVE-2021-23470

9.8 criticalEPSS 1.3%

Critical (9.8) in putil-merge project putil-merge. EPSS 1.3% chance of exploitation in the next 30 days. Fixed in putil-merge 3.8.0.

This affects the package putil-merge before 3.8.0. The merge() function does not check the values passed into the argument. An attacker can supply a malicious value by adjusting the value to include the constructor property. Note: This vulnerability derives from an incomplete fix in https://security.snyk.io/vuln/SNYK-JS-PUTILMERGE-1317077

Severity

CVSS 3.1

9.8 critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS
1.3% chance of exploitation in the next 30 days; higher than 69% of CVEs (scores of 2026-10-31)
CWE
CWE-1321
Published
Modified
Record from
the NVD, synced

Affected

Packages (OSV)

AdvisoryEcosystemPackageAffectedFixed in
GHSA-4g77-cvgw-grvwnpmputil-merge<3.8.03.8.0

References

Check your stackJSON