CVE-2021-23436

CVE-2021-23436 affects the immer package prior to 9.0.6. A prototype pollution/type confusion flaw can bypass CVE-2020-28477 when user-provided path keys are arrays, because the check for proto /constructor in applyPatches_ fails for ['proto '] (or ['constructor']). This may enable remote code ex...

CVE-2021-3757

CVE-2021-3757 refers to a prototype pollution flaw in the immer module used by Node.js. The vulnerability arises from improper modification of Object.prototype attributes via proto /constructor payloads, potentially enabling remote code execution, information disclosure, or denial of service. Doc...