CVE-2021-23568

9.8 criticalEPSS 1.5%

Critical (9.8) in eggjs extend2. EPSS 1.5% chance of exploitation in the next 30 days. Fixed in extend2 1.0.1.

The package extend2 before 1.0.1 are vulnerable to Prototype Pollution via the extend function due to unsafe recursive merge.

Severity

9.8 critical

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS: 1.5% chance of exploitation in the next 30 days; higher than 74% of CVEs (scores of 2026-10-31)
CWE: CWE-1321
Published: 2022-01-10
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Advisory	Ecosystem	Package	Affected	Fixed in
GHSA-gjm5-83cw-p3p2	npm	extend2	<1.0.1	1.0.1