CVE-2021-41167

modern-async is an open source JavaScript tooling library for asynchronous operations using async/await and promises. In affected versions a bug affecting two of the functions in this library: forEachSeries and forEachLimit. They should limit the concurrency of some actions but, in practice, they don't. Any code calling these functions will be written thinking they would limit the concurrency but they won't. This could lead to potential security issues in other projects. The problem has been patched in 1.0.4. There is no workaround.

• CWE-400
• CWE-770

• https://github.com/nicolas-van/modern-async/commit/0010d28de1b15d51db3976080e26357fa7144436Patch, Third Party Advisory
• https://github.com/nicolas-van/modern-async/issues/5Exploit, Issue Tracking, Patch, Third Party Advisory
• https://github.com/nicolas-van/modern-async/security/advisories/GHSA-3pcq-34w5-p4g2Third Party Advisory
• https://github.com/nicolas-van/modern-async/commit/0010d28de1b15d51db3976080e26357fa7144436Patch, Third Party Advisory
• https://github.com/nicolas-van/modern-async/issues/5Exploit, Issue Tracking, Patch, Third Party Advisory
• https://github.com/nicolas-van/modern-async/security/advisories/GHSA-3pcq-34w5-p4g2Third Party Advisory

Published

Oct 20, 2021

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-41161Combodo iTop is a web based IT Service Management tool. In v…6.1
• CVE-2021-41162Combodo iTop is a web based IT Service Management tool. In 3…6.1
• CVE-2021-41163Discourse is an open source platform for community discussio…9.8
• CVE-2021-41164CKEditor4 is an open source WYSIWYG HTML editor. In affected…5.4
• CVE-2021-41165CKEditor4 is an open source WYSIWYG HTML editor. In affected…5.4
• CVE-2021-41166The Nextcloud Android app is the Android client for Nextclou…5.3
• CVE-2021-41168Snudown is a reddit-specific fork of the Sundown Markdown pa…6.5
• CVE-2021-41169Sulu is an open-source PHP content management system based o…4.8
• CVE-2021-4117yetiforcecrm is vulnerable to Business Logic Errors4.3
• CVE-2021-41170neoan3-apps/template is a neoan3 minimal template engine. Ve…9.8
• CVE-2021-41171eLabFTW is an open source electronic lab notebook manager fo…8.8
• CVE-2021-41172AS_Redis is an AntSword plugin for Redis. The Redis Manage p…5.4