CVE-2021-28860

In Node.js mixme, prior to v0.5.1, an attacker can add or alter properties of an object via '__proto__' through the mutate() and merge() functions. The polluted attribute will be directly assigned to every object in the program. This will put the availability of the program at risk causing a potential denial of service (DoS).

• CWE-1321

• https://github.com/adaltas/node-mixme/commit/cfd5fbfc32368bcf7e06d1c5985ea60e34cd4028Patch, Third Party Advisory
• https://github.com/adaltas/node-mixme/issues/1Issue Tracking, Third Party Advisory
• https://github.com/adaltas/node-mixme/security/advisories/GHSA-79jw-6wg7-r9g4Patch, Third Party Advisory
• https://security.netapp.com/advisory/ntap-20210618-0005/Third Party Advisory
• https://www.npmjs.com/~davidThird Party Advisory
• https://github.com/adaltas/node-mixme/commit/cfd5fbfc32368bcf7e06d1c5985ea60e34cd4028Patch, Third Party Advisory
• https://github.com/adaltas/node-mixme/issues/1Issue Tracking, Third Party Advisory
• https://github.com/adaltas/node-mixme/security/advisories/GHSA-79jw-6wg7-r9g4Patch, Third Party Advisory
• https://security.netapp.com/advisory/ntap-20210618-0005/Third Party Advisory
• https://www.npmjs.com/~davidThird Party Advisory

Published

May 3, 2021

Last Modified

Jul 9, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-28847MobaXterm before 21.0 allows remote servers to cause a denia…7.5
• CVE-2021-28848Mintty before 3.4.5 allows remote servers to cause a denial …7.5
• CVE-2021-28855In Deark before 1.5.8, a specially crafted input file can ca…5.5
• CVE-2021-28856In Deark before v1.5.8, a specially crafted input file can c…5.5
• CVE-2021-28857TP-Link's TL-WPA4220 4.0.2 Build 20180308 Rel.37064 username…7.5
• CVE-2021-28858TP-Link's TL-WPA4220 4.0.2 Build 20180308 Rel.37064 does not…5.5
• CVE-2021-28861Python 3.x through 3.10 has an open redirection vulnerabilit…7.4
• CVE-2021-28874SerenityOS fixed as of c9f25bca048443e317f1994ba9b106f238668…7.8
• CVE-2021-28875In the standard library in Rust before 1.50.0, read_to_end()…7.5
• CVE-2021-28876In the standard library in Rust before 1.52.0, the Zip imple…5.3
• CVE-2021-28877In the standard library in Rust before 1.51.0, the Zip imple…7.5
• CVE-2021-28878In the standard library in Rust before 1.52.0, the Zip imple…7.5