CVE-2021-3666
9.8 CRITICALbody-parser-xml is vulnerable to Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')
Published: 2021-09-13 · Last updated: 2026-06-17
Severity and scoring
- CVSS
- 9.8 CRITICAL
- Vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- CWE
- CWE-1321
Affected products
| Vendor | Product |
|---|---|
| xml_body_parser_project | xml_body_parser |
Description
body-parser-xml is vulnerable to Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')
Source: NVD
References
- [NVD]https://nvd.nist.gov/vuln/detail/CVE-2021-3666
- [Patch]https://github.com/fiznool/body-parser-xml/commit/d46ca622560f7c9a033cd9321c61e92558150d63
- [Exploit reference]https://huntr.dev/bounties/1-other-fiznool/body-parser-xml
- [Patch]https://github.com/fiznool/body-parser-xml/commit/d46ca622560f7c9a033cd9321c61e92558150d63
- [Exploit reference]https://huntr.dev/bounties/1-other-fiznool/body-parser-xml
Related CVEs
Same CWE
- CVE-2026-48714 — i18next-http-middleware is a middleware to be used with Node.js web frameworks like express or Fastify and also for Deno (9.1 CRITICAL)
- CVE-2026-48713 — Versions prior to 2.6.6 are vulnerable to prototype pollution via crafted missing-key strings when used to persist missing translation ke... (9.1 CRITICAL)
- CVE-2026-12209 — A security vulnerability has been detected in RubyLouvre avalon up to 2.2.10 (5.3 MEDIUM)
- CVE-2026-12208 — A weakness has been identified in jsonata-js jsonata up to 2.2.0 (5.3 MEDIUM)
- CVE-2026-53609 — ApostropheCMS is an open-source Node.js content management system (9.1 CRITICAL)