Code Injection in pac-resolver

CRITICAL 9.8CVE-2021-23406 · GHSA-9j49-mfvp-vmhm · Published 24/08/2021 · updated 17/06/2026

In short

CVE-2021-23406 is a CRITICAL (CVSS 9.8) vulnerability affecting pac-resolver (pac-resolver project), degenerator, pac-resolver.
Chance of exploitation in the next 30 days (EPSS): 2.9%, higher than 87.2% of all vulnerabilities.
Fix: update to 5.0.0, 3.0.1 or later.

Package	Affected versions	Patched versions
pac-resolver pac-resolver_project	`< 5.0.0`	`5.0.0`
degenerator npm	`< 3.0.1`	`3.0.1`
pac-resolver npm	`< 5.0.0`	`5.0.0`

Description

This affects the package pac-resolver before 5.0.0. This can occur when used with untrusted input, due to unsafe PAC file handling. NOTE: The fix for this vulnerability is applied in the node-degenerator library, a dependency written by the same maintainer.

NVD description

This affects the package pac-resolver before 5.0.0. This can occur when used with untrusted input, due to unsafe PAC file handling. **NOTE:** The fix for this vulnerability is applied in the node-degenerator library, a dependency written by the same maintainer.

References

nvd.nist.gov/vuln/detail/CVE-2021-23406 · ADVISORY
TooTallNate/node-degenerator commit 9d25bb6 · WEB
TooTallNate/node-degenerator commit ccc3445 · WEB
github.com/TooTallNate · WEB
TooTallNate/node-pac-resolver release 5.0.0 · WEB
snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1568506 · WEB
snyk.io/vuln/SNYK-JS-PACRESOLVER-1564857 · WEB

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free