High DLA-3291-1 2 CVEs

node-object-path - security update

Published Jan 29, 2023 · Updated Mar 9, 2026

Ecosystem: Debian

Fixed packages 1

Release	Package	Fixed in
Debian · 10	node-object-path	0.11.4-2+deb10u2

Vulnerabilities 2

High 7.5

CVE-2021-3805

Prototype Pollution in mariocasciaro/object-path

object-path is vulnerable to Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')

mariocasciaro mariocasciaro/object-path object-path node-object-path Debian Ubuntu npm

Sep 17, 2021
Medium 5.6

CVE-2021-23434

Prototype Pollution

This affects the package object-path before 0.11.6. A type confusion vulnerability can lead to a bypass of CVE-2020-15256 when the path components used in the path parameter are arrays. In particular, the condition currentPath === '__proto__' returns false if…

object-path node-object-path node-object-path Debian Ubuntu npm

Aug 27, 2021