Prototype Pollution in node-jsonpointer

CRÍTICO 9.8CVE-2021-23807 · GHSA-282f-qqgm-c34q · Published 03/11/2021 · updated 17/06/2026

En resumen

CVE-2021-23807 es una vulnerabilidad CRÍTICO (CVSS 9.8) que afecta a jsonpointer (janl), jsonpointer, org.webjars.npm:json-pointer.
Probabilidad de explotación en los próximos 30 días (EPSS): 2.8%, mayor que el 86.3% de las vulnerabilidades.
Solución: actualizar a 5.0.0 o posterior.

Package	Affected versions	Patched versions
jsonpointer janl	`< 5.0.0`	`5.0.0`
jsonpointer npm	`< 5.0.0`	`5.0.0`
org.webjars.npm:json-pointer npm	`< 5.0.0`	`5.0.0`

Description

This affects the package jsonpointer before 5.0.0. A type confusion vulnerability can lead to a bypass of a previous Prototype Pollution fix when the pointer components are arrays.

NVD description

This affects the package jsonpointer before 5.0.0. A type confusion vulnerability can lead to a bypass of a previous Prototype Pollution fix when the pointer components are arrays.

References

nvd.nist.gov/vuln/detail/CVE-2021-23807 · ADVISORY
janl/node-jsonpointer#51 · WEB
janl/node-jsonpointer commit a0345f3 · WEB
janl/node-jsonpointer · PACKAGE
snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1910273 · WEB
snyk.io/vuln/SNYK-JS-JSONPOINTER-1577288 · WEB

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free