CVE-2021-28860: Adaltas Mixme

Critical severity, CVSS 9.1. EPSS: 1.8% chance of exploitation in the next 30 days.

In Node.js mixme, prior to v0.5.1, an attacker can add or alter properties of an object via '__proto__' through the mutate() and merge() functions. The polluted attribute will be directly assigned to every object in the program. This will put the availability of the program at risk causing a potential denial of service (DoS).

Affected products

• Adaltas Mixme: before 0.5.1 (fixed in 0.5.1)

Published 2021-05-03. Last modified 2026-07-09.