Predictive Vulnerability Intelligence.

Product

  • Product
  • Pricing
  • Documentation

Company

  • About
  • Partnerships
  • Blog
  • Support

Legal

  • Terms
  • Privacy
  • Data Licensing

© 2026 FAUCET Technologies LLC. All rights reserved.

CVE-2021-23807

30
FAUCET Score

CVE-2021-23807 is a critical type confusion vulnerability affecting the 'jsonpointer' package prior to version 5.0.0, specifically impacting products like 'janl jsonpointer'. This flaw allows for a bypass of a previous Prototype Pollution fix when array components are used in pointers. With a CVSS score of 9.8, it presents a severe risk (complete compromise of confidentiality, integrity, and availability) due to its network-based attack vector and low attack complexity. Despite its criticality, there is currently no evidence of active exploitation, public exploit code (Metasploit, Nuclei, ExploitDB), or significant community discussion or media coverage.

Impacted Technologies

VendorProductVersion(s)CPE
< 5.0.0CPE matchmatch criteria
cpe:2.3:a:janl:jsonpointer:*:*:*:*:*:node.js:*:*

CVSS Data

CVSS version used by this source: 3.1

5.6MEDIUM

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L

Attack Vector
NETWORK
Attack Complexity
HIGH
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
LOW
Integrity Impact
LOW
Availability Impact
LOW
Exploitability Score
2.2
Impact Score
3.4
CvssVersion
3.1

Exploit Intelligence

EPSS Score
2.54%
Probability of exploitation in next 30 days
EPSS Percentile
83.3%
Percentile rank of EPSS score among Peer Group
As of 2026-07-27
Model: v2026.06.15
This CVE's current EPSS score of 0.0254 is in the 74th percentile among its peer group of 36,862 CVEs.

Social Chatter

The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.3 Bluesky, 0.3 Mastodon, and 2.4 GitHub mentions.

Media Mentions

No media coverage found for this CVE.

The average CVE in this peer group has 0.3 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.

Remediation

Patch Available

Vendor Patches (5)

github_advisorypatch availablevia nvd_reference
View patch
npmpatch availablevia ghsa
Product: jsonpointerFixed in: 5.0.0
npmpatch availablevia ghsa
Product: org.webjars.npm:json-pointerFixed in: 5.0.0
redhatend of lifevia redhat_api
Product: Red Hat OpenShift Container Platform 4Fixed in: openshift4/ose-metering-hadoop
redhatend of lifevia redhat_api
Product: Red Hat Quay 3Fixed in: quay/quay-rhel8

Vendor Advisories (2)

npmGHSA-282f-qqgm-c34qmedium

Prototype Pollution in node-jsonpointer

Nov 8, 2021
redhatCVE-2021-23807Moderate

nodejs-jsonpointer: type confusion vulnerability can lead to a bypass of a previous prototype pollution fix when the pointer components are arrays

Aug 31, 2021

References

github.com / janl/node-jsonpointer/commit/a0345f3550cd9c4d89f33b126390202b89510ad4
PatchThird Party Advisory
github.com / janl/node-jsonpointer/pull/51
PatchThird Party Advisory
snyk.io / vuln/SNYK-JAVA-ORGWEBJARSNPM-1910273
ExploitMitigationPatchThird Party AdvisoryVDB Entry
snyk.io / vuln/SNYK-JS-JSONPOINTER-1577288
ExploitMitigationPatchThird Party AdvisoryVDB Entry