Packages / immer / Security

HighVulnerabilityGHSA-c36v-fmgq-m8hxCVE-2021-3757Published 7 Sep 2021

Prototype Pollution in immer

Your version

Affected releases · immer

  • 9.x9.0.0 – 9.0.5Fixed in 9.0.6
  • 8.x and older7.0.0 – 8.0.4No fix, no longer updated

On 9.x, the newest line:

npm install immer@9.0.6
Every release on a timeline
11.x

  1. Not affected

    11.0.0 – 11.2.9

    35 releases, latest

9.x

  1. Affected

    9.0.0 – 9.0.5

    6 releases

  2. Fixed

    9.0.6 – 9.0.21

    16 releases

8.x

  1. Affected

    8.0.0 – 8.0.4

    5 releases

7.x

  1. Affected

    7.0.0 – 7.0.15

    16 releases

193 stable releases of immer, oldest to newest, one row per major.

What happens

immer is vulnerable to Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution').