Most recent entries from all

bdu:2022-01861

cnvd-2021-67507

EUVD-2026-164704

fkie_cve-2021-23434

This affects the package object-path before 0.11.6. A type confusion vulnerability can lead to a bypass of CVE-2020-15256 when the path components used in the path parameter are arrays. In particular, the condition currentPath === '__proto__' returns false if currentPath is ['__proto__']. This is because the === operator returns always false when the type of the operands is different.

GHSA-v39p-96qg-c8rf — Prototype Pollution in object-path

Affected: npm: object-path

This affects the package object-path before 0.11.6. A type confusion vulnerability can lead to a bypass of CVE-2020-15256 when the path components used in the path parameter are arrays. In particular, the condition `currentPath === '__proto__'` returns false if `currentPath` is `['__proto__']`. This is because the `===` operator returns always false when the type of the operands is different.

gsd-2021-23434

RHSA-2021:3873 — Red Hat Security Advisory: Red Hat Advanced Cluster Management 2.2.9 security, bug, and container updates

semver-regex: inefficient regular expression complexity nginx: Off-by-one in ngx_resolver_copy() when labels are followed by a pointer to a root domain name object-path: Type confusion vulnerability can lead to a bypass of CVE-2020-15256 nodejs-set-value: type confusion allows bypass of CVE-2019-10747 redis: Lua scripts can overflow the heap-based Lua stack redis: Integer overflow issue with Streams redis: Integer overflow bug in the ziplist data structure redis: Out of bounds read in lua debugger protocol parser redis: Denial of service via Redis Standard Protocol (RESP) request redis: Integer overflow issue with intsets redis: Integer overflow issue with strings

UBUNTU-CVE-2021-23434

Affected: Ubuntu:18.04:LTS: node-object-path, Ubuntu:20.04:LTS: node-object-path, Ubuntu:24.04:LTS: node-object-path, Ubuntu:25.10: node-object-path, Ubuntu:26.04:LTS: node-object-path