Not a U.S. government website. NDD is an independent vulnerability database by Volerion and is not affiliated with or endorsed by NIST or NVD.
VOLERION
Volerion Security Research

NOT DEFERRED DATABASE

VULNERABILITIES

CVE-2021-23438 Details

Description

This affects the package mpath before 0.8.4. A type confusion vulnerability can lead to a bypass of CVE-2018-16490. In particular, the condition ignoreProperties.indexOf(parts[i]) !== -1 returns -1 if parts[i] is ['__proto__']. This is because the method that has been called if the input is an array is Array.prototype.indexOf() and not String.prototype.indexOf(). They behave differently depending on the type of the input.

Metrics

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.

URLSource(s)Tag(s)
https://github.com/aheckmann/mpath/commit/89402d2880d4ea3518480a8c9847c541f2d824fc CVEPatchThird Party Advisory
https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1579548 CVEExploitThird Party Advisory
https://snyk.io/vuln/SNYK-JS-MPATH-1577289 CVEExploitThird Party Advisory
https://github.com/aheckmann/mpath/commit/89402d2880d4ea3518480a8c9847c541f2d824fc [email protected]PatchThird Party Advisory
https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1579548 [email protected]ExploitThird Party Advisory

see all 6 references

Weakness Enumeration

CWE-IDCWE NameSource
CWE-843Access of Resource Using Incompatible Type ('Type Confusion')[email protected]

Affected Products

ProductVersions
mpath project mpath
< 0.8.4

CPE

  • cpe:2.3:a:mpath_project:mpath:*:*:*:*:*:node.js:*:*

Remediation

  • No remediation found in references.

Change History

4 change records found show changes

QUICK INFO

CVE Dictionary Entry:
CVE-2021-23438
NVD Published Date:
Sep 1, 2021
NVD Last Modified:
Jun 17, 2026
Source:
[email protected]
CVE-2021-23438 Details - Not Deferred