CVE-2021-23419: Open-Graph Project Open-Graph

Critical severity, CVSS 9.8. EPSS: 1.1% chance of exploitation in the next 30 days.

This affects the package open-graph before 0.2.6. The function parse could be tricked into adding or modifying properties of Object.prototype using a __proto__ or constructor payload.

Affected products

• Open-Graph Project Open-Graph: before 0.2.6 (fixed in 0.2.6)

Published 2021-08-08. Last modified 2026-06-17.