CVE-2021-3918: Prototype Pollution in json-schema
Summary
CVE-2021-3918: json-schema is vulnerable to Prototype Pollution. Affects json-schema versions < 0.4.0. Fixed in 0.4.0. How to fix ↓
Also tracked for
- node-json-schema · Debian:11
The same CVE-2021-3918 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The json-schema package is an npm package used for validating JSON data against a specified schema. It provides a set of rules and constraints to ensure the integrity and structure of JSON objects. However, versions prior to 0.4.0 are susceptible to a vulnerability known as Prototype Pollution.
Vulnerability Detail
Prototype Pollution is a type of vulnerability that allows an attacker to modify the prototype of an object, leading to unexpected behavior and potential security issues. In the case of json-schema, this vulnerability arises due to improper control over the modification of object prototype attributes. An attacker can manipulate the schema to inject malicious properties or modify existing ones, potentially leading to data tampering, code execution, or denial of service.
How To Fix
Latest published version: 0.4.0 as of 22 Oct 2026
npm install json-schema@0.4.0The newest release already contains this fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is crucial to update the json-schema package to the fixed version to mitigate the risk of exploitation.
Conclusion
The json-schema package prior to version 0.4.0 is vulnerable to Prototype Pollution. It is crucial to update to the fixed version to mitigate the risk of exploitation. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for json-schema →
FAQ
json-schema is an npm package used for validating JSON data against a specified schema. It helps ensure the integrity and structure of JSON objects.
Prototype Pollution is a vulnerability that allows an attacker to modify the prototype of an object, leading to unexpected behavior and potential security issues.
This vulnerability can lead to data tampering, code execution, or denial of service, depending on how the attacker exploits the modified object prototype.
To fix this vulnerability, update the json-schema package to version 0.4.0 or later using the command 'npm install json-schema@0.4.0'.
No, there is no known workaround for this vulnerability. Updating to the fixed version is the recommended solution.
