npm immer vulnerabilities

Latest npm immer CVEs

Newest publication first

1. CVE-2021-3757 Prototype Pollution in immerjs/immer

   Published 2021-09-02

   Critical·CVSS 9.8 EPSS 1.7%

   immer is vulnerable to Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')

2. CVE-2021-23436 Prototype Pollution

   Published 2021-09-01

   Critical·CVSS 9.8 EPSS 1.8%

   This affects the package immer before 9.0.6. A type confusion vulnerability can lead to a bypass of CVE-2020-28477 when the user-provided keys used in the path parameter are arrays. In particular, this bypass is possible because the condition (p === "proto" || p === "constructor"...

3. CVE-2020-28477 Prototype Pollution

   Published 2021-01-19

   High·CVSS 7.5 EPSS 2.3%

   This affects all versions of package immer.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.