CVE-2021-25947: Prototype Pollution in nestie
Summary
CVE-2021-25947: Prototype pollution in nestie. Affects nestie versions < 1.0.1. Fixed in 1.0.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The 'nestie' package is an npm package that provides functionality for nesting objects in JavaScript. It allows users to easily create nested objects and access their properties. The package is widely used in various applications and projects.
Vulnerability Detail
A prototype pollution vulnerability has been discovered in 'nestie' versions 0.0.0 through 1.0.0. This vulnerability allows an attacker to manipulate the prototype of objects, leading to a denial of service and potentially remote code execution. By injecting malicious data into the application, an attacker can modify the behavior of the 'nestie' package and exploit the application's functionality.
How To Fix
Minimum fixed version
1.0.1
This is the first release that contains the fix.
npm install nestie@1.0.1Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is crucial to update to the fixed version of the 'nestie' package to mitigate the risk of exploitation.
Conclusion
The 'nestie' package is vulnerable to prototype pollution, which can result in a denial of service and potential remote code execution. It is crucial to update to version 1.0.1 or later to mitigate the risk. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for nestie →
FAQ
Prototype pollution is a vulnerability that occurs when an attacker can modify the prototype of objects, leading to unexpected behavior and potential security issues.
This vulnerability can result in a denial of service and may allow an attacker to execute arbitrary code remotely, potentially compromising the security and integrity of the affected system.
At the time of this advisory, there are no known public exploits specifically targeting this vulnerability. However, it is crucial to update to the fixed version to prevent any potential exploitation.
Yes, all versions of 'nestie' from 0.0.0 through 1.0.0 are vulnerable to this prototype pollution issue. It is recommended to upgrade to version 1.0.1 or later to mitigate the risk.
You can use the Vulert Playground at Vulert Scanner to check if your application is affected by this vulnerability. Simply provide your package-lock.json file, and Vulert will analyze it in real-time to identify any open-source vulnerabilities, including this one.
