Prototype pollution in swiper - swiper

Description

A prototype pollution vulnerability exists in the the npm package swiper (>=6.5.1, < 12.1.2). Despite a previous fix that attempted to mitigate prototype pollution by checking whether user input contained a forbidden key, it is still possible to pollute Object.prototype via a crafted input using Array.prototype.

Recommendation

Update the swiper package to the latest compatible version. Followings are version details:

• Affected version(s): >= 6.5.1, < 12.1.2
• Patched version(s): 12.1.2

References

• GHSA-hmx5-qpq5-p643
• CVE-2026-27212
• CWE-1321
• CAPEC-310
• OWASP 2021-A6

Related Issues

• CASL Ability is Vulnerable to Prototype Pollution - CVE-2026-1774
• Axios: Prototype pollution auth subfields can inject Basic auth - CVE-2026-67314
• @rvf/set-get has a prototype pollution issue that's reachable via @rvf/core preprocessFormData (HTTP form data) - CVE-2026-44483
• lodash vulnerable to Prototype Pollution via array path bypass in `_.unset` and `_.omit` - CVE-2026-2950

You might also like:

How to Secure your NodeJs Express Javascript Application - part 1

How to Secure your NodeJs Express Javascript Application - part 2

10 Secure Coding Best Practices to Follow in Every Project

Tags:

npm

swiper