CVE-2020-28477

CVE-2020-28477 affects the Node.js module immer and is described as a denial of service arising from a prototype pollution flaw. The core issue is tied to how patch application handles player-supplied path keys (including array-like keys), which in some disclosures can bypass part of the vulnerab...

CVE-2021-23436

CVE-2021-23436 affects the immer package prior to 9.0.6. A prototype pollution/type confusion flaw can bypass CVE-2020-28477 when user-provided path keys are arrays, because the check for proto /constructor in applyPatches_ fails for ['proto '] (or ['constructor']). This may enable remote code ex...