set-in Affected by Prototype Pollution

Description

A prototype pollution vulnerability exists in the the npm package set-in (>=2.0.1). Despite a previous fix that attempted to mitigate prototype pollution by checking whether user input contained a forbidden key, it is still possible to pollute Object.prototype via a crafted input using Array.prototype. This has been fixed in version 2.0.5.

Recommendation

Update the set-in package to the latest compatible version. Followings are version details:

• Affected version(s): >= 2.0.1, < 2.0.5
• Patched version(s): 2.0.5

References

• GHSA-2c4m-g7rx-63q7
• CVE-2026-26021
• CWE-1321
• CAPEC-310
• OWASP 2021-A6

Related Issues

• Prototype Pollution in set-in - CVE-2022-25354
• Prototype pollution in set-in - set-in - CVE-2020-28273
• Velocity.js has a Prototype Pollution vulnerability through #set path assignment - CVE-2026-44966
• seroval Affected by Prototype Pollution via JSON Deserialization - CVE-2026-23736

You might also like:

How to Secure your NodeJs Express Javascript Application - part 1

How to Secure your NodeJs Express Javascript Application - part 2

10 Secure Coding Best Practices to Follow in Every Project

Tags:

npm

set-in