CVE-2021-43138

Name of the Vulnerable Software and Affected Versions Async versions 2.x through 2.6.3 Async versions 3.x through 3.2.1

Description The issue is related to the mapValues() function in the Async library, which is used for working with asynchronous JavaScript. It involves the incorrect control of modifications to an object's prototype attributes. This could allow a remote attacker to elevate their privileges. A malicious user can exploit this issue via the mapValues() method, also known as lib/internal/iterator.js createObjectIterator prototype pollution.

Recommendations For Async versions 2.x through 2.6.3, update to version 2.6.4 to resolve the issue. For Async versions 3.x through 3.2.1, update to version 3.2.2 to resolve the issue. As a temporary workaround, consider disabling the mapValues() function until a patch is available.