CVE-2021-43138 — Prototype Pollution in async

Description

In Async before 2.6.4 and 3.x before 3.2.2, a malicious user can obtain privileges via the mapValues() method, aka lib/internal/iterator.js createObjectIterator prototype pollution.

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

SUSE

Security tracker ↗

Release	Package	Fixed in	Advisory
SLES 15 SP5	grafana	9.5.1-150200.3.41.3	SUSE-SU-2023:2575-1, SUSE-RU-2024:0511-1
SLES 15 SP4	grafana	9.5.1-150200.3.41.3	SUSE-SU-2023:2575-1
SLES 15 SP2	bind	9.16.6-150000.12.65.1	SUSE-SU-2023:2578-1
SLES 15 SP1	bind	9.16.6-150000.12.65.1	SUSE-SU-2023:2578-1

Show 19 more (older releases, extended support, other products)

Release	Package	Fixed in	Advisory
SLES for SAP 15 SP2	bind	9.16.6-150000.12.65.1	SUSE-SU-2023:2578-1
SLES for SAP 15 SP1	bind	9.16.6-150000.12.65.1	SUSE-SU-2023:2578-1
SLE HPC 15 SP2	bind	9.16.6-150000.12.65.1	SUSE-SU-2023:2578-1
SLE HPC 15 SP1	bind	9.16.6-150000.12.65.1	SUSE-SU-2023:2578-1
SUSE Manager Server Module 4.3	golang-github-lusitaniae-apache_exporter	1.0.0-150000.1.20.1	SUSE-SU-2024:0487-1
SUSE Manager Server Module 4.2	drools	7.17.0-150300.4.6.2	SUSE-SU-2022:3314-1
SUSE Manager Server Module 4.2	httpcomponents-asyncclient	4.1.4-150300.3.3.2	SUSE-SU-2022:3314-1
SUSE Manager Server Module 4.2	image-sync-formula	0.1.1661440526.b08d95b-150300.3.3.2	SUSE-SU-2022:3314-1
SUSE Manager Server Module 4.2	inter-server-sync	0.2.3-150300.8.22.2	SUSE-SU-2022:3314-1
SUSE Manager Server Module 4.2	patterns-suse-manager	4.2-150300.4.12.2	SUSE-SU-2022:3314-1
SUSE Manager Server Module 4.2	py27-compat-salt	3000.3-150300.7.7.23.2	SUSE-SU-2022:3314-1
SUSE Manager Server Module 4.2	salt-netapi-client	0.20.0-150300.3.9.4	SUSE-SU-2022:3314-1
SUSE Manager Server Module 4.2	saltboot-formula	0.1.1661440526.b08d95b-150300.3.12.2	SUSE-SU-2022:3314-1
SUSE Manager Server Module 4.2	spacecmd	4.2.19-150300.4.27.2	SUSE-SU-2022:3314-1
SUSE Manager Server Module 4.2	spacewalk-admin	4.2.12-150300.3.15.3	SUSE-SU-2022:3314-1
SUSE Manager Server Module 4.2	spacewalk-backend	4.2.24-150300.4.29.5	SUSE-SU-2022:3314-1
SUSE Manager Server Module 4.2	spacewalk-certs-tools	4.2.18-150300.3.24.3	SUSE-SU-2022:3314-1
SUSE Manager Server Module 4.2	spacewalk-client-tools	4.2.20-150300.4.24.3	SUSE-SU-2022:3314-1
SUSE Manager Server Module 4.2	spacewalk-java	4.2.41-150300.3.43.5	SUSE-SU-2022:3314-1
SUSE Manager Server Module 4.2	spacewalk-search	4.2.8-150300.3.12.2	SUSE-SU-2022:3314-1
SUSE Manager Server Module 4.2	spacewalk-web	4.2.29-150300.3.27.3	SUSE-SU-2022:3314-1
SUSE Manager Server Module 4.2	subscription-matcher	0.29-150300.6.12.2	SUSE-SU-2022:3314-1
SUSE Manager Server Module 4.2	susemanager	4.2.37-150300.3.41.1	SUSE-SU-2022:3314-1
SUSE Manager Server Module 4.2	susemanager-doc-indexes	4.2-150300.12.33.4	SUSE-SU-2022:3314-1
SUSE Manager Server Module 4.2	susemanager-docs_en	4.2-150300.12.33.2	SUSE-SU-2022:3314-1
SUSE Manager Server Module 4.2	susemanager-schema	4.2.24-150300.3.27.3	SUSE-SU-2022:3314-1
SUSE Manager Server Module 4.2	susemanager-sls	4.2.27-150300.3.33.4	SUSE-SU-2022:3314-1
SUSE Manager Server Module 4.2	uyuni-common-libs	4.2.7-150300.3.9.2	SUSE-SU-2022:3314-1
SUSE Manager Server 4.3	release-notes-susemanager	4.3.2-150400.3.15.1	SUSE-SU-2022:3761-1
SUSE Manager Server 4.2	release-notes-susemanager	4.2.9-150300.3.54.1	SUSE-SU-2022:3313-1
SUSE Manager Retail Branch Server 4.3	release-notes-susemanager-proxy	4.3.2-150400.3.9.3	SUSE-SU-2022:3761-1
SUSE Manager Retail Branch Server 4.2	release-notes-susemanager-proxy	4.2.9-150300.3.43.1	SUSE-SU-2022:3313-1
SUSE Manager Proxy Module 4.3	golang-github-lusitaniae-apache_exporter	1.0.0-150000.1.20.1	SUSE-SU-2024:0487-1
SUSE Manager Proxy Module 4.3	zypp-plugin-spacewalk	1.0.14-150000.3.35.1	SUSE-SU-2023:2578-1
SUSE Manager Proxy Module 4.2	mgr-daemon	4.2.10-150300.2.9.4	SUSE-SU-2022:3314-1
SUSE Manager Proxy Module 4.2	patterns-suse-manager	4.2-150300.4.12.2	SUSE-SU-2022:3314-1
SUSE Manager Proxy Module 4.2	spacecmd	4.2.19-150300.4.27.2	SUSE-SU-2022:3314-1
SUSE Manager Proxy Module 4.2	spacewalk-backend	4.2.24-150300.4.29.5	SUSE-SU-2022:3314-1
SUSE Manager Proxy Module 4.2	spacewalk-certs-tools	4.2.18-150300.3.24.3	SUSE-SU-2022:3314-1
SUSE Manager Proxy Module 4.2	spacewalk-client-tools	4.2.20-150300.4.24.3	SUSE-SU-2022:3314-1
SUSE Manager Proxy Module 4.2	spacewalk-proxy	4.2.12-150300.3.21.3	SUSE-SU-2022:3314-1
SUSE Manager Proxy Module 4.2	spacewalk-web	4.2.29-150300.3.27.3	SUSE-SU-2022:3314-1
SUSE Manager Proxy Module 4.2	susemanager-tftpsync-recv	4.2.5-150300.3.6.2	SUSE-SU-2022:3314-1
SUSE Manager Proxy Module 4.2	uyuni-common-libs	4.2.7-150300.3.9.2	SUSE-SU-2022:3314-1
SUSE Manager Proxy Module 4.2	zypp-plugin-spacewalk	1.0.14-150000.3.35.1	SUSE-SU-2023:2578-1
SUSE Manager Proxy 4.3	release-notes-susemanager-proxy	4.3.2-150400.3.9.3	SUSE-SU-2022:3761-1
SUSE Manager Proxy 4.2	release-notes-susemanager-proxy	4.2.9-150300.3.43.1	SUSE-SU-2022:3313-1
SUSE Manager Client Tools for SLE Micro 5	bind	9.16.6-150000.12.65.1	SUSE-SU-2023:2578-1
SUSE Manager Client Tools for SLE Micro 5	dracut-saltboot	0.1.1681904360.84ef141-150000.1.50.1	SUSE-SU-2023:2578-1
SUSE Manager Client Tools for SLE Micro 5	uyuni-proxy-systemd-services	4.3.10-150000.1.15.1	SUSE-SU-2024:0487-1
SUSE Manager Client Tools Beta for SLE Micro 5	dracut-saltboot	0.1.1681904360.84ef141-159000.3.30.1	SUSE-SU-2024:0196-1
SUSE Manager Client Tools Beta for SLE Micro 5	golang-github-QubitProducts-exporter_exporter	0.4.0-159000.4.6.1	SUSE-SU-2024:0196-1
SUSE Manager Client Tools Beta for SLE Micro 5	prometheus-blackbox_exporter	0.24.0-159000.3.6.1	SUSE-SU-2024:0196-1
SUSE Manager Client Tools Beta for SLE Micro 5	uyuni-proxy-systemd-services	5.0.1-159000.3.9.1	SUSE-SU-2024:0196-1
SUSE Manager Client Tools 15	ansible	2.9.27-159000.3.9.1	SUSE-SU-2024:0196-1
SUSE Manager Client Tools 15	dracut-saltboot	0.1.1681904360.84ef141-150000.1.50.1	SUSE-SU-2024:0196-1, SUSE-SU-2023:2578-1
SUSE Manager Client Tools 15	golang-github-QubitProducts-exporter_exporter	0.4.0-159000.4.6.1	SUSE-SU-2024:0196-1
SUSE Manager Client Tools 15	golang-github-boynux-squid_exporter	1.6-159000.4.9.1	SUSE-SU-2024:0196-1
SUSE Manager Client Tools 15	golang-github-lusitaniae-apache_exporter	1.0.0-150000.1.20.1	SUSE-SU-2024:0487-1, SUSE-SU-2024:0196-1
SUSE Manager Client Tools 15	golang-github-prometheus-prometheus	2.45.0-150000.3.53.1	SUSE-SU-2024:0487-1, SUSE-SU-2024:0196-1
SUSE Manager Client Tools 15	grafana	9.5.1-150000.1.48.5	SUSE-SU-2024:0487-1, SUSE-SU-2024:0196-1, SUSE-SU-2023:2578-1
SUSE Manager Client Tools 15	mgr-daemon	4.3.7-150000.1.41.1	SUSE-SU-2024:0487-1, SUSE-SU-2023:2578-1
SUSE Manager Client Tools 15	mgr-push	5.0.1-159000.4.21.1	SUSE-SU-2024:0196-1
SUSE Manager Client Tools 15	prometheus-blackbox_exporter	0.24.0-159000.3.6.1	SUSE-SU-2024:0196-1
SUSE Manager Client Tools 15	prometheus-postgres_exporter	0.10.1-150000.1.17.1	SUSE-SU-2024:0487-1, SUSE-SU-2024:0196-1
SUSE Manager Client Tools 15	python-hwdata	2.3.5-159000.5.13.1	SUSE-SU-2024:0196-1
SUSE Manager Client Tools 15	python-pyvmomi	6.7.3-159000.3.6.1	SUSE-SU-2024:0196-1
SUSE Manager Client Tools 15	rhnlib	5.0.1-159000.6.30.1	SUSE-SU-2024:0196-1
SUSE Manager Client Tools 15	spacecmd	4.3.21-150000.3.98.1	SUSE-SU-2024:0487-1, SUSE-SU-2024:0196-1, SUSE-SU-2023:2578-1
SUSE Manager Client Tools 15	spacewalk-client-tools	4.3.18-150000.3.86.2	SUSE-SU-2024:0487-1, SUSE-SU-2024:0196-1
SUSE Manager Client Tools 15	supportutils-plugin-salt	1.2.2-159000.5.9.1	SUSE-SU-2024:0196-1
SUSE Manager Client Tools 15	supportutils-plugin-susemanager-client	5.0.1-159000.6.15.1	SUSE-SU-2024:0196-1
SUSE Manager Client Tools 15	uyuni-common-libs	4.3.8-150000.1.33.1	SUSE-SU-2024:0196-1, SUSE-SU-2023:2578-1
SUSE Manager Client Tools 15	uyuni-proxy-systemd-services	4.3.10-150000.1.15.1	SUSE-SU-2024:0487-1, SUSE-SU-2024:0196-1
SUSE Manager Client Tools 15	zypp-plugin-spacewalk	1.0.14-150000.3.35.1	SUSE-SU-2023:2578-1
SUSE Manager Client Tools 12	golang-github-QubitProducts-exporter_exporter	0.4.0-4.6.2	SUSE-SU-2024:0191-1
SUSE Manager Client Tools 12	golang-github-boynux-squid_exporter	1.6-4.9.2	SUSE-SU-2024:0191-1
SUSE Manager Client Tools 12	golang-github-lusitaniae-apache_exporter	1.0.0-1.21.2	SUSE-SU-2024:0486-1, SUSE-SU-2024:0191-1
SUSE Manager Client Tools 12	golang-github-prometheus-alertmanager	0.26.0-1.24.2	SUSE-SU-2024:0486-1, SUSE-SU-2024:0191-1
SUSE Manager Client Tools 12	golang-github-prometheus-node_exporter	1.5.0-4.15.4	SUSE-SU-2024:0191-1
SUSE Manager Client Tools 12	golang-github-prometheus-prometheus	2.45.0-1.50.2	SUSE-SU-2024:0486-1, SUSE-SU-2024:0191-1
SUSE Manager Client Tools 12	golang-github-prometheus-promu	0.14.0-4.12.2	SUSE-SU-2024:0191-1
SUSE Manager Client Tools 12	grafana	9.5.1-1.48.1	SUSE-SU-2024:0486-1, SUSE-SU-2024:0191-1, SUSE-SU-2023:2579-1
SUSE Manager Client Tools 12	kiwi-desc-saltboot	0.1.1687520761.cefb248-4.15.2	SUSE-SU-2024:0191-1
SUSE Manager Client Tools 12	mgr-daemon	4.3.7-1.41.1	SUSE-SU-2024:0486-1, SUSE-SU-2023:2579-1
SUSE Manager Client Tools 12	mgr-push	5.0.1-4.21.4	SUSE-SU-2024:0191-1
SUSE Manager Client Tools 12	prometheus-blackbox_exporter	0.24.0-3.6.3	SUSE-SU-2024:0191-1
SUSE Manager Client Tools 12	prometheus-postgres_exporter	0.10.1-1.17.2	SUSE-SU-2024:0486-1, SUSE-SU-2024:0191-1
SUSE Manager Client Tools 12	python-hwdata	2.3.5-15.12.2	SUSE-SU-2024:0191-1
SUSE Manager Client Tools 12	rhnlib	5.0.1-24.30.3	SUSE-SU-2024:0191-1
SUSE Manager Client Tools 12	spacecmd	4.3.21-38.121.1	SUSE-SU-2024:0486-1, SUSE-SU-2024:0191-1, SUSE-SU-2023:2579-1
SUSE Manager Client Tools 12	spacewalk-client-tools	4.3.18-52.95.2	SUSE-SU-2024:0486-1
SUSE Manager Client Tools 12	supportutils-plugin-salt	1.2.2-9.9.2	SUSE-SU-2024:0191-1
SUSE Manager Client Tools 12	supportutils-plugin-susemanager-client	5.0.1-9.15.2	SUSE-SU-2024:0191-1
SUSE Manager Client Tools 12	system-user-grafana +1	1.0.0-3.7.2	SUSE-SU-2024:0191-1
SUSE Manager Client Tools 12	uyuni-common-libs	4.3.8-1.33.1	SUSE-SU-2024:0191-1, SUSE-SU-2023:2579-1
SUSE Manager Client Tools 12	zypp-plugin-spacewalk	1.0.14-30.42.1	SUSE-SU-2023:2579-1
SUSE Enterprise Storage 7	bind	9.16.6-150000.12.65.1	SUSE-SU-2023:2578-1

openSUSE

Security tracker ↗

Release	Package	Fixed in	Advisory
openSUSE Tumbleweed	grafana	9.3.6-1.1	openSUSE-SU-2024:12723-1
openSUSE Leap 15.5	dracut-saltboot	0.1.1681904360.84ef141-150000.1.50.1	SUSE-SU-2023:2578-1
openSUSE Leap 15.5	golang-github-lusitaniae-apache_exporter	1.0.0-150000.1.20.1	SUSE-SU-2024:0487-1
openSUSE Leap 15.5	grafana	9.5.1-150200.3.41.3	SUSE-SU-2023:2575-1, SUSE-RU-2024:0511-1
openSUSE Leap 15.5	prometheus-postgres_exporter	0.10.1-150000.1.17.1	SUSE-SU-2024:0487-1
openSUSE Leap 15.5	spacecmd	4.3.21-150000.3.98.1	SUSE-SU-2024:0487-1, SUSE-SU-2023:2578-1
openSUSE Leap 15.5	wire	0.5.0-150000.1.12.3	SUSE-SU-2023:2578-1
openSUSE Leap 15.4	bind	9.16.6-150000.12.65.1	SUSE-SU-2023:2578-1
openSUSE Leap 15.4	dracut-saltboot	0.1.1681904360.84ef141-150000.1.50.1	SUSE-SU-2023:2578-1
openSUSE Leap 15.4	grafana	9.5.1-150200.3.41.3	SUSE-SU-2023:2575-1
openSUSE Leap 15.4	spacecmd	4.3.21-150000.3.98.1	SUSE-SU-2023:2578-1
openSUSE Leap 15.4	wire	0.5.0-150000.1.12.3	SUSE-SU-2023:2578-1

Affected packages

Ecosystem	Package	Affected	Fixed	Record
npm	async	>= 3.0.0, < 3.2.2	3.2.2	GHSA-fwr7-v2mv-hh25
npm	async	>= 2.0.0, < 2.6.4	2.6.4	GHSA-fwr7-v2mv-hh25

Advisories 16

WID-SEC-2022-0909 IBM DB2: Mehrere Schwachstellen ermöglichen Codeausführung BSI CERT-Bund (WID) · Aug 9, 2026
SUSE-SU-2024:0191-1 Security Beta update for SUSE Manager Client Tools SUSE / openSUSE Security Updates · Feb 4, 2026
SUSE-SU-2023:2575-1 Security update for SUSE Manager Client Tools SUSE / openSUSE Security Updates · Feb 4, 2026
SUSE-SU-2022:3314-1 Security update for SUSE Manager Server 4.2 SUSE / openSUSE Security Updates · Feb 4, 2026
SUSE-SU-2022:3313-1 Security update for release-notes-susemanager, release-notes-susemanager-proxy SUSE / openSUSE Security Updates · Feb 4, 2026
SUSE-SU-2023:2579-1 Security update for SUSE Manager Client Tools SUSE / openSUSE Security Updates · Feb 4, 2026
SUSE-RU-2024:0511-1 Recommended update for grafana SUSE / openSUSE Security Updates · Feb 4, 2026
SUSE-SU-2024:0486-1 Security update for SUSE Manager Client Tools SUSE / openSUSE Security Updates · Feb 4, 2026
SUSE-SU-2022:3761-1 Security update for release-notes-susemanager, release-notes-susemanager-proxy SUSE / openSUSE Security Updates · Feb 4, 2026
SUSE-SU-2023:2578-1 Security update for SUSE Manager Client Tools SUSE / openSUSE Security Updates · Feb 4, 2026
SUSE-SU-2024:0196-1 Security Beta update for SUSE Manager Client Tools and Salt SUSE / openSUSE Security Updates · Feb 4, 2026
openSUSE-SU-2024:12723-1 grafana-9.3.6-1.1 on GA media SUSE / openSUSE Security Updates · May 7, 2025
SUSE-SU-2024:0487-1 Security update for SUSE Manager Client Tools SUSE / openSUSE Security Updates · May 2, 2025
WID-SEC-2023-0318 Red Hat Migration Toolkit for Containers: Mehrere Schwachstellen BSI CERT-Bund (WID) · Apr 29, 2025
WID-SEC-2023-1800 HCL BigFix: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jul 18, 2023
WID-SEC-2022-1476 SUSE Manager: Mehrere Schwachstellen BSI CERT-Bund (WID) · Mar 2, 2023

Prototype Pollution in async