VYPR
← All advisories
High severityNVD Advisory· Published Sep 17, 2021· Updated Sep 16, 2024

Prototype Pollution

CVE-2021-23442

Description

This affects all versions of package @cookiex/deep. The global proto object can be polluted using the __proto__ object.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

All versions of @cookiex/deep are vulnerable to prototype pollution via __proto__.

Vulnerability

All versions of the npm package @cookiex/deep are vulnerable to prototype pollution [1][2]. The library's deep() function recursively merges objects without proper validation, allowing an attacker to pollute the global Object.prototype using the __proto__ property [3]. This affects versions prior to 0.0.6.

Exploitation

An attacker can exploit this by crafting an object with a __proto__ property containing malicious properties and passing it to the deep() function [2][3]. The recursive merge will copy these properties onto Object.prototype, affecting all objects in the application.

Impact

Successful exploitation can lead to denial of service (DoS) or remote code execution (RCE) due to the ability to override properties across the entire application [2]. The attacker can inject properties that alter the behavior of the application, potentially leading to full compromise.

Mitigation

The vulnerability is fixed in version 0.0.6 of @cookiex/deep [3][4]. Users should upgrade to this version or later. If upgrading is not possible, avoid passing untrusted objects to the deep() function as a workaround [2].

References
  1. NVD - CVE-2021-23442
  2. Snyk Vulnerability Database | Snyk
  3. @cookiex/deep npm package is vulnerable to prototype pollution vulnerability prior to version 0.0.6.
  4. GitHub - tony-tsx/cookiex-deep

AI Insight generated on May 21, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
@cookiex/deepnpm
< 0.0.70.0.7

Affected products

3

Patches

1
b5bea2b7f34a

fix: prototype pollution fix #1

https://github.com/tony-tsx/cookiex-deepTonySep 13, 2021via ghsa
commit
1 file changed · +2 −2
  • src/assigner.ts+2 −2 modified
    @@ -1,12 +1,12 @@
 const untracker = [ undefined, null ]
-
+const invalids = [ '__proto__', 'constructor', 'prototype' ]
 const Assigner = function( delegate: ( a: any, b: any ) => any, useuntrack: boolean = true ): ( ...args: any[] ) => any {
   const assigner = ( ...args: any[] ) => {
-    console.log( { args } )
     return args.reduce( ( a, b ) => {
       if ( untracker.includes( a ) ) throw new TypeError( `can't convert ${a} to object` )
       if ( useuntrack && untracker.includes( b ) ) return a
       Object.keys( b ).forEach( key => {
+        if ( invalids.includes( key ) ) return void 0
         if ( untracker.includes( a[key] ) ) a[key] = b[key]
         else a[key] = delegate.call( this, a[key], b[key] )
       } )

Vulnerability mechanics

Generated on May 9, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.

References

5

News mentions

0

No linked articles in our index yet.