{"action":"Upgrade vm2 to 3.9.4 or later.","affected":[{"fixed":"3.9.4","introduced":"0"}],"component":"vm2","cve_ids":["CVE-2021-23449"],"ecosystem":"npm","epss":0.0359,"exploited":false,"fixed_versions":["3.9.4"],"ghsa_id":"GHSA-rjf2-j2r6-q8gr","id":"tcs_01M5KG99FKXYZPXJBWK2TQMSFN","modified_at":"2026-07-08T06:49:31.458796413Z","published_at":"2021-10-19T15:28:45Z","references":["https://osv.dev/vulnerability/GHSA-rjf2-j2r6-q8gr","https://nvd.nist.gov/vuln/detail/CVE-2021-23449","https://github.com/patriksimek/vm2/issues/363","https://github.com/patriksimek/vm2/commit/b4f6e2bd2c4a1ef52fc4483d8e35f28bc4481886","https://github.com/patriksimek/vm2","https://github.com/patriksimek/vm2/releases/tag/3.9.4","https://security.netapp.com/advisory/ntap-20211029-0010","https://snyk.io/vuln/SNYK-JS-VM2-1585918"],"severity":{"label":"critical","score":9.8},"sources":[{"source":"osv","source_id":"GHSA-rjf2-j2r6-q8gr","url":"https://osv.dev/vulnerability/GHSA-rjf2-j2r6-q8gr"}],"summary":"Prototype Pollution in vm2"}