CVE catalog

CVE-2021-23518

node-cached-path-relative: CVE-2021-23518

[CVE catalog]

Severity
High · CVSS 8.6CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L
Published
Source
[NVD] · [CVE record]
EPSS
1.94% · Oct 25, 2026

The package cached-path-relative before 1.1.0 are vulnerable to Prototype Pollution via the cache variable that is set as {} instead of Object.create(null) in the cachedPathRelative function, which allows access to the parent prototype properties when the object is used to create the cached relative path. When using the origin path as __proto__, the attribute of the object is accessed instead of a path. **Note:** This vulnerability derives from an incomplete fix in https://security.snyk.io/vuln/SNYK-JS-CACHEDPATHRELATIVE-72573

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debiannode-cached-path-relativesid1.1.0+~1.0.2-1fixed
Debiannode-cached-path-relativeforky1.1.0+~1.0.2-1fixed
Debiannode-cached-path-relativetrixie1.1.0+~1.0.0-3fixed
Debiannode-cached-path-relativebookworm1.1.0+~1.0.0-3fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debiannode-cached-path-relativesourcesid1.1.0+~1.0.0-1not yet assignedNot reported[1004338]
Debiannode-cached-path-relativesourceforky1.1.0+~1.0.0-1not yet assignedNot reported[1004338]
Debiannode-cached-path-relativesourcetrixie1.1.0+~1.0.0-1not yet assignedNot reported[1004338]
Debiannode-cached-path-relativesourcebookworm1.1.0+~1.0.0-1not yet assignedNot reported[1004338]

[Debian bug #1004338]

OpenFactory catalog packages

[Debian 12 (Bookworm)]

  • [node-cached-path-relative]Fixed
    Details (2)

    • 1.1.0+~1.0.0-3 · all · bookworm

      Fixed · Fixed: 1.1.0+~1.0.0-1

      dsa · node-cached-path-relative · debian · bookworm; dsa · node-cached-path-relative · debian · 12

    • 1.1.0+~1.0.0-3 · all · bookworm

      Fixed · Fixed: 1.1.0+~1.0.0-1

      dsa · node-cached-path-relative · debian · bookworm; dsa · node-cached-path-relative · debian · 12

[Debian 13 (Trixie)]

  • [node-cached-path-relative]Fixed
    Details (2)

    • 1.1.0+~1.0.0-3 · all · trixie

      Fixed · Fixed: 1.1.0+~1.0.0-1

      dsa · node-cached-path-relative · debian · 13

    • 1.1.0+~1.0.0-3 · all · trixie

      Fixed · Fixed: 1.1.0+~1.0.0-1

      dsa · node-cached-path-relative · debian · 13

Observed:

References

[Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX]