← All advisories

Medium severity5.6GHSA Advisory· Published Aug 11, 2021· Updated Jun 17, 2026

CVE-2021-23421

CVE-2021-23421

Description

All versions of package merge-change are vulnerable to Prototype Pollution via the utils.set function.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected packages

Versions sourced from the GitHub Security Advisory.

Package	Affected versions	Patched versions
merge-changenpm	<= 1.8.1	—

Affected products

3

Vladimirshestakov/Merge ChangeGHSA
Range: <= 1.8.1
Merge Change Project/Merge Change
cpe:2.3:a:merge-change_project:merge-change:*:*:*:*:*:node.js:*:*
ghsa-coords
pkg:npm/merge-change
Range: <= 1.8.1

Patches

Vulnerability mechanics

References

5

snyk.io/vuln/SNYK-JS-MERGECHANGE-1310985nvdExploitThird Party AdvisoryWEB
github.com/advisories/GHSA-f9cv-665r-275hghsaADVISORY
nvd.nist.gov/vuln/detail/CVE-2021-23421ghsaADVISORY
github.com/VladimirShestakov/merge-change/blob/9901f145e06158f284f52de42e6ba5b0f702fb65/utils.jsghsaWEB
github.com/VladimirShestakov/merge-change/blob/9901f145e06158f284f52de42e6ba5b0f702fb65/utils.js%23L89-L123nvdBroken Link

News mentions

0

No linked articles in our index yet.