---
title: "GHSA-33f9-j839-rf8h: Prototype Pollution in immer"
description: "Critical severity. Prototype Pollution in immer. Affects immer; fixed in 9.0.6."
url: https://inlinr.com/advisories/GHSA-33f9-j839-rf8h
lang: en
---

[Packages](https://inlinr.com/packages) / [immer](https://inlinr.com/packages/immer) / [Security](https://inlinr.com/packages/immer/security)

Critical Vulnerability GHSA-33f9-j839-rf8h CVE-2021-23436 Published 2 Sep 2021

# Prototype Pollution in immer

Your version 

Affected releases · [immer](https://inlinr.com/packages/immer)

- 9.x 9.0.0 – 9.0.5 Fixed in 9.0.6
- 8.x and older 7.0.0 – 8.0.4 No fix, no longer updated

On 9.x, the newest line:

```
npm install immer@9.0.6
```

Every release on a timeline

11.x 

1. Not affected

11.0.0 – 11.2.9  
35 releases, latest

9.x 

1. Affected

9.0.0 – 9.0.5  
6 releases
2. Fixed

9.0.6 – 9.0.21  
16 releases

8.x 

1. Affected

8.0.0 – 8.0.4  
5 releases

7.x 

1. Affected

7.0.0 – 7.0.15  
16 releases

193 stable releases of immer, oldest to newest, one row per major.

## What happens

This affects the package immer before 9.0.6\. A type confusion vulnerability can lead to a bypass of CVE-2020-28477 when the user-provided keys used in the path parameter are arrays. In particular, this bypass is possible because the condition `(p === "__proto__" || p === "constructor")` in `applyPatches_` returns false if `p` is `['__proto__']` (or `['constructor']`). The `===` operator (strict equality operator) returns false if the operands have different type.

## How it is exploited

Exploitable over the network, with no account and no action from a user.

- **Confidentiality**: high
- **Integrity**: high
- **Availability**: high

CVSS:3.1/​AV:N/​AC:L/​PR:N/​UI:N/​S:U/​C:H/​I:H/​A:H

## References

- [NVD](https://nvd.nist.gov/vuln/detail/CVE-2021-23436 "https://nvd.nist.gov/vuln/detail/CVE-2021-23436")  
nvd.nist.gov/vuln/detail/CVE-2021-23436
- [Fix commit](https://github.com/immerjs/immer/commit/fa671e55ee9bd42ae08cc239102b665a23958237 "https://github.com/immerjs/immer/commit/fa671e55ee9bd42ae08cc239102b665a23958237")  
fa671e5
- [Package](https://github.com/immerjs/immer "https://github.com/immerjs/immer")  
github.com/immerjs/immer
- [Reference](https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1579266 "https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1579266")  
snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1579266
- [Reference](https://snyk.io/vuln/SNYK-JS-IMMER-1540542 "https://snyk.io/vuln/SNYK-JS-IMMER-1540542")  
snyk.io/vuln/SNYK-JS-IMMER-1540542