CVE-2021-23807

Published: Nov 3, 2021Modified: Jun 17, 2026

9.8

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Exploitability: 3.9 / Impact: 5.9

Source: NVD

Description

This affects the package jsonpointer before 5.0.0. A type confusion vulnerability can lead to a bypass of a previous Prototype Pollution fix when the pointer components are arrays.

Affected (1)

Products: Janl: Jsonpointer

Janl

1 product

Jsonpointer

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Janl Jsonpointer	Before 5.0.0

Related CWEs

CWE-843

Access of Resource Using Incompatible Type ('Type Confusion')

The product allocates or initializes a resource such as a pointer, object, or variable using one type, but it later accesses that resource using a type that is incompatible with the original type.

References (8)

https://github.com/janl/node-jsonpointer/commit/a0345f3550cd9c4d89f33b126390202b89510ad4

Source: report@snyk.io

PatchThird Party Advisory

https://github.com/janl/node-jsonpointer/pull/51

Source: report@snyk.io

PatchThird Party Advisory

https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1910273

Source: report@snyk.io

ExploitMitigationPatchThird Party AdvisoryVDB Entry

https://snyk.io/vuln/SNYK-JS-JSONPOINTER-1577288

Source: report@snyk.io

ExploitMitigationPatchThird Party AdvisoryVDB Entry

https://github.com/janl/node-jsonpointer/commit/a0345f3550cd9c4d89f33b126390202b89510ad4

Source: af854a3a-2127-422b-91ae-364da2661108

PatchThird Party Advisory

https://github.com/janl/node-jsonpointer/pull/51

Source: af854a3a-2127-422b-91ae-364da2661108

PatchThird Party Advisory

https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1910273

Source: af854a3a-2127-422b-91ae-364da2661108

ExploitMitigationPatchThird Party AdvisoryVDB Entry

https://snyk.io/vuln/SNYK-JS-JSONPOINTER-1577288

Source: af854a3a-2127-422b-91ae-364da2661108

ExploitMitigationPatchThird Party AdvisoryVDB Entry

Timeline

No history available yet.