---
title: "GHSA-c36v-fmgq-m8hx: Prototype Pollution in immer"
description: "High severity. Prototype Pollution in immer. Affects immer; fixed in 9.0.6."
url: https://inlinr.com/advisories/GHSA-c36v-fmgq-m8hx
lang: en
---

[Packages](https://inlinr.com/packages) / [immer](https://inlinr.com/packages/immer) / [Security](https://inlinr.com/packages/immer/security)

High Vulnerability GHSA-c36v-fmgq-m8hx CVE-2021-3757 Published 7 Sep 2021

# Prototype Pollution in immer

Your version 

Affected releases · [immer](https://inlinr.com/packages/immer)

- 9.x 9.0.0 – 9.0.5 Fixed in 9.0.6
- 8.x and older 7.0.0 – 8.0.4 No fix, no longer updated

On 9.x, the newest line:

```
npm install immer@9.0.6
```

Every release on a timeline

11.x 

1. Not affected

11.0.0 – 11.2.9  
35 releases, latest

9.x 

1. Affected

9.0.0 – 9.0.5  
6 releases
2. Fixed

9.0.6 – 9.0.21  
16 releases

8.x 

1. Affected

8.0.0 – 8.0.4  
5 releases

7.x 

1. Affected

7.0.0 – 7.0.15  
16 releases

193 stable releases of immer, oldest to newest, one row per major.

## What happens

immer is vulnerable to Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution').

## How it is exploited

Exploitable over the network, with no account and no action from a user.

- **Confidentiality**: none
- **Integrity**: none
- **Availability**: high

CVSS:3.0/​AV:N/​AC:L/​PR:N/​UI:N/​S:U/​C:N/​I:N/​A:H

## References

- [NVD](https://nvd.nist.gov/vuln/detail/CVE-2021-3757 "https://nvd.nist.gov/vuln/detail/CVE-2021-3757")  
nvd.nist.gov/vuln/detail/CVE-2021-3757
- [Fix commit](https://github.com/immerjs/immer/commit/fa671e55ee9bd42ae08cc239102b665a23958237 "https://github.com/immerjs/immer/commit/fa671e55ee9bd42ae08cc239102b665a23958237")  
fa671e5
- [Package](https://github.com/immerjs/immer "https://github.com/immerjs/immer")  
github.com/immerjs/immer
- [Reference](https://huntr.dev/bounties/23d38099-71cd-42ed-a77a-71e68094adfa "https://huntr.dev/bounties/23d38099-71cd-42ed-a77a-71e68094adfa")  
huntr.dev/bounties/23d38099-71cd-42ed-a77a-71e6…