CVE-2021-29491: mixme - Potential Denial of Service (DoS) via Proto Pollution
Summary
CVE-2021-29491: Use of Potentially Dangerous Function in mixme. Affects mixme versions < 0.5.1. Fixed in 0.5.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
mixme is an npm package used in Node.js applications for object manipulation. It provides functions like mutate() and merge() to add or alter properties of an object. However, in mixme v0.5.0, there is a vulnerability that allows an attacker to pollute the 'proto' attribute of objects, potentially leading to a denial of service (DoS) attack. This means that the availability of the program could be compromised.
Vulnerability Detail
The vulnerability arises from the mutate() and merge() functions in mixme v0.5.0. By manipulating the 'proto' attribute, an attacker can directly assign a polluted attribute to every object in the program. This can result in a DoS attack, impacting the availability of the program. The issue has been assigned a CVSS score of 7.1, indicating a high severity level.
How To Fix
Latest published version: 2.0.2 as of 22 Oct 2026
npm install mixme@2.0.2Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
0.5.1
This is the first release that contains the fix.
npm install mixme@0.5.1Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. Updating the mixme package to the fixed version is the recommended solution.
Conclusion
In conclusion, the mixme package in Node.js versions prior to 0.5.1 is vulnerable to proto pollution, which can result in a denial of service (DoS) attack. It is crucial to update the package to version 0.5.1 or later to mitigate this vulnerability. For further support on vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for mixme →
FAQ
mixme is an npm package used for object manipulation in Node.js applications. It provides functions like mutate() and merge() to add or alter properties of an object.
The vulnerability allows an attacker to pollute the 'proto' attribute of objects, potentially leading to a denial of service (DoS) attack. This can compromise the availability of the program.
To fix this vulnerability, update the mixme package to version 0.5.1 or later. This version includes the necessary fixes to prevent 'proto' pollution.
No specific workaround is mentioned for this vulnerability. Updating the mixme package to the fixed version is the recommended solution.
The vulnerability has a CVSS score of 7.1, indicating a high severity level.
Related vulnerabilities
Recent vulnerabilities recorded for mixme.
