VYPR
← All advisories
High severityNVD Advisory· Published Apr 6, 2022· Updated Aug 4, 2024

CVE-2021-43138

CVE-2021-43138

Description

In Async before 2.6.4 and 3.x before 3.2.2, a malicious user can obtain privileges via the mapValues() method, aka lib/internal/iterator.js createObjectIterator prototype pollution.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Prototype pollution in Async's mapValues() allows attackers to inject properties into Object prototype, leading to privilege escalation in Node.js applications.

Vulnerability

Prototype pollution vulnerability exists in Async library's mapValues() method, specifically in the createObjectIterator function in lib/internal/iterator.js. Affected versions are Async before 2.6.4 and 3.x before 3.2.2. An attacker can pass a crafted iterator that pollutes the Object prototype, allowing arbitrary property injection [2][4].

Exploitation

An attacker needs to supply a malicious iteratee function to mapValues() that modifies the __proto__ or constructor.prototype of the objects being iterated. No authentication is required if the attacker can control the input to mapValues(). The vulnerability can be triggered in Node.js environments where Async is used [1][3].

Impact

Successful exploitation results in prototype pollution, which can lead to privilege escalation, denial of service, or remote code execution depending on the application's use of polluted properties. The attacker can modify global objects, potentially bypass security checks or inject malicious behavior [2].

Mitigation

Fixed in Async versions 2.6.4 and 3.2.2. Users should upgrade to these versions. No EOL status; the library continues to be maintained. No workaround is available besides upgrading [1].

References
  1. async/CHANGELOG.md at v2.6.4 · caolan/async
  2. NVD - CVE-2021-43138
  3. Edit fiddle - JSFiddle - Code Playground
  4. async/lib/mapValuesLimit.js at master · caolan/async

AI Insight generated on May 21, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
asyncnpm
>= 3.0.0, < 3.2.23.2.2
asyncnpm
>= 2.0.0, < 2.6.42.6.4

Affected products

132

Patches

2
8f7f90342a65

Fix prototype pollution vulnerability (#1828)

https://github.com/caolan/asyncMatt RiedemannApr 13, 2022via ghsa
commit
2 files changed · +14 −0
  • lib/internal/iterator.js+3 −0 modified
    @@ -27,6 +27,9 @@ function createObjectIterator(obj) {
     var len = okeys.length;
     return function next() {
         var key = okeys[++i];
+        if (key === '__proto__') {
+            return next();
+        }
         return i < len ? {value: obj[key], key: key} : null;
     };
 }
  • mocha_test/mapValues.js+11 −0 modified
    @@ -39,6 +39,17 @@ describe('mapValues', function () {
                 done();
             });
         });
+
+        it('prototype pollution', (done) => {
+            var input = JSON.parse('{"a": 1, "b": 2, "__proto__": { "exploit": true }}');
+
+            async.mapValues(input, (val, key, next) => {
+                next(null, val)
+            }, (err, result) => {
+                expect(result.exploit).to.equal(undefined)
+                done(err);
+            })
+        })
     });
 
     context('mapValues', function () {
e1ecdbf79264

Fix prototype pollution vulnerability

https://github.com/caolan/asyncAlexander EarlyOct 28, 2021via ghsa
commit
2 files changed · +14 −0
  • lib/internal/iterator.js+3 −0 modified
    @@ -26,6 +26,9 @@ function createObjectIterator(obj) {
     var len = okeys.length;
     return function next() {
         var key = okeys[++i];
+        if (key === '__proto__') {
+            return next();
+        }
         return i < len ? {value: obj[key], key} : null;
     };
 }
  • test/mapValues.js+11 −0 modified
    @@ -60,6 +60,17 @@ describe('mapValues', () => {
                 done();
             }, 50);
         });
+
+        it('prototype pollution', (done) => {
+            var input = JSON.parse('{"a": 1, "b": 2, "__proto__": { "exploit": true }}');
+
+            async.mapValues(input, (val, key, next) => {
+                next(null, val)
+            }, (err, result) => {
+                expect(result.exploit).to.equal(undefined)
+                done(err);
+            })
+        })
     });
 
     context('mapValues', () => {

Vulnerability mechanics

Generated on May 9, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.

References

19

News mentions

0

No linked articles in our index yet.