CVE-2022-37621

9.8 criticalEPSS 1.4%

Critical (9.8) in browserify-shim project browserify-shim. EPSS 1.4% chance of exploitation in the next 30 days. Fixed in browserify-shim 3.8.16.

Prototype pollution vulnerability in function resolveShims in resolve-shims.js in thlorenz browserify-shim 3.8.15 via the fullPath variable in resolve-shims.js.

Severity

CVSS 3.1

9.8 critical

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS: 1.4% chance of exploitation in the next 30 days; higher than 71% of CVEs (scores of 2026-10-31)
CWE: CWE-1321
Published: 2022-10-28
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

browserify-shim_project:browserify-shim

Packages (OSV)

Advisory	Ecosystem	Package	Affected	Fixed in
GHSA-r737-347m-wqc7	npm	browserify-shim	<3.8.16	3.8.16

References

https://github.com/thlorenz/browserify-shim/blob/464b32bbe142664cd9796059798f6c738ea3de8f/lib/resolve-shims.js#L158
https://github.com/thlorenz/browserify-shim/blob/464b32bbe142664cd9796059798f6c738ea3de8f/lib/resolve-shims.js#L37
https://github.com/thlorenz/browserify-shim/issues/247
https://github.com/thlorenz/browserify-shim/blob/464b32bbe142664cd9796059798f6c738ea3de8f/lib/resolve-shims.js#L158
https://github.com/thlorenz/browserify-shim/blob/464b32bbe142664cd9796059798f6c738ea3de8f/lib/resolve-shims.js#L37

Check your stack JSON