{"action":"Upgrade async to 2.6.4 or later.","affected":[{"fixed":"3.2.2","introduced":"3.0.0"},{"fixed":"2.6.4","introduced":"2.0.0"}],"component":"async","cve_ids":["CVE-2021-43138"],"ecosystem":"npm","epss":0.03346,"exploited":false,"fixed_versions":["3.2.2","2.6.4"],"ghsa_id":"GHSA-fwr7-v2mv-hh25","id":"tcs_01M5KFPG7N97NF4SZM92DP7RPW","modified_at":"2024-06-24T21:23:09Z","published_at":"2022-04-07T00:00:17Z","references":["https://osv.dev/vulnerability/GHSA-fwr7-v2mv-hh25","https://nvd.nist.gov/vuln/detail/CVE-2021-43138","https://github.com/caolan/async/pull/1828","https://github.com/caolan/async/commit/8f7f90342a6571ba1c197d747ebed30c368096d2","https://github.com/caolan/async/commit/e1ecdbf79264f9ab488c7799f4c76996d5dca66d","https://github.com/caolan/async","https://github.com/caolan/async/blob/master/lib/internal/iterator.js","https://github.com/caolan/async/blob/master/lib/mapValuesLimit.js","https://github.com/caolan/async/blob/v2.6.4/CHANGELOG.md#v264","https://github.com/caolan/async/compare/v2.6.3...v2.6.4","https://jsfiddle.net/oz5twjd9","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MTEUUTNIEBHGKUKKLNUZSV7IEP6IP3Q3","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UM6XJ73Q3NAM5KSGCOKJ2ZIA6GUWUJLK","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MTEUUTNIEBHGKUKKLNUZSV7IEP6IP3Q3","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UM6XJ73Q3NAM5KSGCOKJ2ZIA6GUWUJLK","https://security.netapp.com/advisory/ntap-20240621-0006"],"severity":{"label":"high","score":7.8},"sources":[{"source":"osv","source_id":"GHSA-fwr7-v2mv-hh25","url":"https://osv.dev/vulnerability/GHSA-fwr7-v2mv-hh25"}],"summary":"Prototype Pollution in async"}