Prototype pollution in emit function

Description

A prototype pollution in derby can crash the application, if the application author has atypical HTML templates that feed user input into an object key.

Attribute keys are almost always developer-controlled, not end-user-controlled, so this shouldn’t be an issue in practice for most applications.

Recommendation

Update the derby package to the latest compatible version. Followings are version details:

• Affected version(s): **>= 4.0.0-beta1, <= 4.0.0-beta.10

  >= 3.0.0, <= 3.0.1

  <= 2.3.1**

• Patched version(s): **4.0.0-beta.11

  3.0.2

  2.3.2**

References

• GHSA-82jv-9wjw-pqh6
• CWE-1321

Related Issues

• tRPC 11 WebSocket DoS Vulnerability - CVE-2025-43855
• DocsGPT Allows Remote Code Execution - CVE-2025-0868
• Signature Malleabillity in elliptic - CVE-2020-13822
• Joplin Vulnerable to Code Injection - CVE-2022-23340

Tags:

npm

derby