CVE-2021-3757: Prototype Pollution in immer
Summary
CVE-2021-3757: Prototype Pollution in immer. Affects immer versions >= 7.0.0, < 9.0.6. Fixed in 9.0.6. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
immer is an npm package that provides a functional programming API for creating immutable state updates. It is widely used in JavaScript applications to simplify state management and improve performance. However, immer is vulnerable to Prototype Pollution, which is a type of vulnerability that allows an attacker to modify the prototype of an object and introduce malicious properties or methods. This can lead to various security issues, such as remote code execution or privilege escalation.
Vulnerability Detail
The vulnerability in immer arises from improper control over modifications to object prototype attributes. By manipulating the prototype of an object, an attacker can inject malicious properties or methods that may be executed in the context of the application. This can result in unauthorized access, data manipulation, or other malicious activities. The severity of this vulnerability is rated as HIGH with a CVSS score of 7.5.
How To Fix
Latest published version: 11.2.9 as of 23 Oct 2026
npm install immer@11.2.9Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
9.0.6
This is the first release that contains the fix.
npm install immer@9.0.6Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If updating the immer package is not immediately feasible, a temporary workaround is to sanitize and validate any user input or external data before using it to modify object prototypes. This can help prevent the injection of malicious properties or methods. Here is an example of how to sanitize user input in JavaScript:
function sanitizeInput(input) {
if (typeof input !== 'object' || input === null) {
return {};
}
const sanitized = {};
for (const key in input) {
if (Object.prototype.hasOwnProperty.call(input, key)) {
sanitized[key] = input[key];
}
}
return sanitized;
}
Conclusion
In conclusion, the immer package is vulnerable to Prototype Pollution, which can have serious security implications. It is crucial to update the package to the latest version or apply the recommended workaround to mitigate the risk. If you need further assistance or support in addressing this vulnerability, please contact DevNack.com.
See every vulnerability recorded for immer →
FAQ
Prototype Pollution is a vulnerability that allows an attacker to modify the prototype of an object and introduce malicious properties or methods. This can lead to various security issues, such as remote code execution or privilege escalation.
The impact of this vulnerability depends on how the affected package is used in the application. It can potentially lead to unauthorized access, data manipulation, or other malicious activities.
You can use the Vulert Playground (https://vulert.com/scanner) to check if your application is affected by this vulnerability. Simply upload your package-lock.json file and it will analyze the dependencies for any known vulnerabilities.
Yes, the fix for this vulnerability is to update the immer package to version 9.0.6 or later. This version includes the necessary patches to mitigate the Prototype Pollution issue.
If updating the immer package is not immediately feasible, you can sanitize and validate any user input or external data before using it to modify object prototypes. This can help prevent the injection of malicious properties or methods.
Related vulnerabilities
Recent vulnerabilities recorded for immer.
