| Package | Affected versions | Patched versions |
|---|---|---|
| mixme | < 0.5.1 | 0.5.1 |
| mixme | < 0.5.1 | 0.5.1 |
In Node.js mixme v0.5.0, an attacker can add or alter properties of an object via 'proto' through the mutate() and merge() functions. The polluted attribute will be directly assigned to every object in the program. This will put the availability of the program at risk causing a potential denial of service (DoS).
The problem is corrected starting with version 0.5.1.
Issue: https://github.com/adaltas/node-mixme/issues/1 Commit: https://github.com/adaltas/node-mixme/commit/cfd5fbfc32368bcf7e06d1c5985ea60e34cd4028
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free