CVE-2021-23406

This affects the package pac-resolver before 5.0.0. This can occur when used with untrusted input, due to unsafe PAC file handling. **NOTE:** The fix for this vulnerability is applied in the node-degenerator library, a dependency written by the same maintainer.

• https://github.com/TooTallNate/node-degenerator/commit/9d25bb67d957bc2e5425fea7bf7a58b3fc64ff9ePatch, Third Party Advisory
• https://github.com/TooTallNate/node-degenerator/commit/ccc3445354135398b6eb1a04c7d27c13b833f2d5Patch, Third Party Advisory
• https://github.com/TooTallNate/node-pac-resolver/releases/tag/5.0.0Patch, Release Notes, Third Party Advisory
• https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1568506Exploit, Patch, Third Party Advisory
• https://snyk.io/vuln/SNYK-JS-PACRESOLVER-1564857Exploit, Patch, Third Party Advisory
• https://github.com/TooTallNate/node-degenerator/commit/9d25bb67d957bc2e5425fea7bf7a58b3fc64ff9ePatch, Third Party Advisory
• https://github.com/TooTallNate/node-degenerator/commit/ccc3445354135398b6eb1a04c7d27c13b833f2d5Patch, Third Party Advisory
• https://github.com/TooTallNate/node-pac-resolver/releases/tag/5.0.0Patch, Release Notes, Third Party Advisory
• https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1568506Exploit, Patch, Third Party Advisory
• https://snyk.io/vuln/SNYK-JS-PACRESOLVER-1564857Exploit, Patch, Third Party Advisory

Published

Aug 24, 2021

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-23400The package nodemailer before 6.6.1 are vulnerable to HTTP H…8.8
• CVE-2021-23401This affects all versions of package Flask-User. When using …6.1
• CVE-2021-23402All versions of package record-like-deep-assign are vulnerab…9.8
• CVE-2021-23403All versions of package ts-nodash are vulnerable to Prototyp…9.8
• CVE-2021-23404This affects all versions of package sqlite-web. The SQL das…8.8
• CVE-2021-23405This affects the package pimcore/pimcore before 10.0.7. This…8.8
• CVE-2021-23407This affects the package elFinder.Net.Core from 0 and before…7.5
• CVE-2021-23408This affects the package com.graphhopper:graphhopper-web-bun…4.3
• CVE-2021-23409The package github.com/pires/go-proxyproto before 0.6.0 are …7.5
• CVE-2021-2341Vulnerability in the Java SE, Oracle GraalVM Enterprise Edit…3.1
• CVE-2021-23410Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2021-23411Affected versions of this package are vulnerable to Cross-si…6.1