External risk intelligence

Node.js mixme proto Property Pollution Denial of Service

CVE advisorySeverity: CRITICAL (CVSS 9.1)

CVE-2021-28860

This is a low-level utility library used for object manipulation within Node.js applications. It is not an internet-facing service, appliance, or gateway. While it may be included in the dependency chain of public-facing applications, the component itself is a library and not directly reachable or exposed to the public internet by design.

Denial of Service

Adaltas Mixme

before 0.5.1

Halo Surface Signal: 2 out of 5 — less likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This advisory addresses a critical vulnerability found in the Node.js `mixme` utility, which could allow an attacker to alter core object properties. This manipulation can lead to denial-of-service conditions, potentially impacting program availability. The primary concern is to confirm if this specific library is in use within our systems.

Code flaw allows altering object properties.
Affects program availability via denial of service.
Confirm if `mixme` library is in use.

Attack Path

How an attacker could exploit the issue

An attacker could exploit this vulnerability by manipulating object properties through the `mutate()` or `merge()` functions in the Node.js mixme library. This manipulation, specifically targeting the `__proto__` property, could allow an attacker to alter or add properties that are then applied to every object within the program, potentially leading to a denial of service.

Attacker needs to be able to call library functions.
Triggered by manipulating object properties.
Risk of program denial of service.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow an attacker to modify how an application processes objects, potentially disrupting its normal operation. When supported by the advisory, this could lead to a denial of service by altering program behavior.

Application availability.
Via property manipulation.
Program may become unavailable.

Operational Fix

Recommended remediation, mitigation, and detection steps

This advisory affects the `mixme` utility within Node.js applications. Application owners and platform teams are likely responsible for identifying and remediating this vulnerability. The first practical step is to locate all instances of `mixme` in your environment, assess their business criticality and exposure, identify the accountable owner for each instance, and then plan remediation, such as upgrading the library, within a maintenance window.

Own the issue: Application or platform owners.
Verify first: Confirm `mixme` presence and criticality.
Action: Plan controlled upgrade or mitigation.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the Node.js mixme library?

Mixme is a utility library for Node.js designed to handle object manipulation tasks. Developers often incorporate it into their applications to simplify merging or mutating complex data objects. Because it is a foundational component, it may exist deep within an application's dependency tree, serving as a helper tool rather than a standalone service.

How does CVE-2021-28860 work?

This vulnerability is a prototype pollution flaw (CWE-1321). It occurs when the library fails to properly sanitize input, allowing an attacker to inject properties into the base 'prototype' of all objects in the program. By overwriting these core object characteristics, an attacker can cause unexpected behavior, which often crashes the application or makes it unavailable.

What triggers this object manipulation flaw?

The vulnerability is triggered when an application passes unsanitized user-controlled input into the 'mutate()' or 'merge()' functions provided by mixme. Simply having the library installed is not enough to trigger the bug; the application must actively use these specific functions to process untrusted data. Standard operations that do not involve user-supplied keys in these functions remain unaffected.

Is my system at risk according to Halo Surface Signal?

Halo Surface Signal indicates that risk is unlikely. Mixme is a low-level library, not an internet-facing service or gateway. While it can exist in the background of public-facing applications, it is not directly reachable from the internet by design. Your primary focus should be on internal applications where user input might reach these specific library functions.

How should I respond to this advisory?

Start by identifying if your software stack includes the mixme library. If you find it, confirm which versions are in use; versions prior to 0.5.1 are vulnerable. Once identified, evaluate the business criticality of those applications and plan to upgrade to a patched version within your standard maintenance schedule to safely remove the vulnerability.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.

Node.js mixme __proto__ Property Pollution Denial of Service