Prototype Pollution in immer

CRITICAL 9.8CVE-2021-3757 · GHSA-c36v-fmgq-m8hx · Published 02/09/2021 · updated 17/06/2026

In short

CVE-2021-3757 is a CRITICAL (CVSS 9.8) vulnerability affecting immer (immer project), immer.
Chance of exploitation in the next 30 days (EPSS): 1.7%, higher than 76.8% of all vulnerabilities.
Fix: update to 9.0.6 or later.

Package	Affected versions	Patched versions
immer immer_project	`≤ 9.0.5`	No fix yet
immer npm	`≥ 7.0.0, < 9.0.6`	`9.0.6`

immer is vulnerable to Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution').

NVD description

immer is vulnerable to Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')

Running one of these products? Scan your site to see whether it exposes a vulnerable version.