CVE-2021-28860: adaltas mixme
Vulnerability summary
CVE-2021-28860 is a critical (CVSS 9.1) vulnerability in adaltas mixme. EPSS estimates a 1.84% chance of exploitation in the next 30 days, higher than 79% of scored vulnerabilities.
Severe, CVSS 9.1 (NVD); no exploitation reported by the 5 checked sources; EPSS 2% (FIRST, 03-11-2026)
Source freshness unavailable
How is this decided?Timeline
- 03-05-2021PublishedVulnerability first disclosed.
- 09-07-2026Last modifiedVulnerability information updated.
Description
In Node.js mixme, prior to v0.5.1, an attacker can add or alter properties of an object via '__proto__' through the mutate() and merge() functions. The polluted attribute will be directly assigned to every object in the program. This will put the availability of the program at risk causing a potential denial of service (DoS).
CVSS metrics
3 scores · 2 sources · 2 versions- OSV · NpmEcosystem advisory · calculated9.1CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
EPSS trend
Probability
1.84%
Chance of exploitation in the next 30 days
Percentile
79%
Versus all other CVEs
30-day change
No change 0.00 pp
From 1.84% on 04-10-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Known conditions: network-reachable, no authentication, no user interaction (CVSS vector). Other conditions: not stated in public data.
Adaltas1 product
- mixme< 0.5.1
Npm1 product
- mixme< 0.5.1
2 vendors · 2 products
References
11 links- github.com/adaltas/node-mixme/commit/cfd5fbfc32368bcf7e06d1c5985ea60e34cd4028WEBPatchThird Party Advisory
- security.netapp.com/advisory/ntap-20210618-0005/Third Party Advisory
Show all 11 references
- nodejs.comWEB