# CVE-2021-3805: object-path prototype pollution in del() function

Source: https://junglewise.ai/threats/cve-2021-3805-object-path-prototype-pollution-in-del-function  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2021-09-20. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2021-3805 · Severity: low · CVSS 3 · Published 2021-09-20

object-path is a popular Node.js library used to access and manipulate nested JavaScript object properties. A prototype pollution vulnerability in its del() function allows attackers to modify core Object properties without authentication, potentially affecting the behavior of all objects in an application and causing denial of service or data manipulation.

Technologies: [object-path (npm)](https://junglewise.ai/threats/technologies/object-path). Vendors: [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2021-3805 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2021-3805 being exploited in the wild.

**How severe is CVE-2021-3805?** Low severity, with a CVSS score of 3, published 20 September 2021.

**Which products and versions are affected?** object-path (npm) SEMVER:introduced=0,fixed=0.11.8.

**Is there a fix for CVE-2021-3805?** Yes. object-path (npm): upgrade to 0.11.8 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2021-3805 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2021-3805?** Check whether you run object-path (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- object-path (npm): upgrade to 0.11.8 or later

  ```sh
  npm install object-path@0.11.8
  ```


## Technical details

object-path is vulnerable to prototype pollution (CWE-1321, CWE-915) due to improper validation in the del() function, which fails to restrict deletion of Object prototype attributes. An attacker can craft input that modifies Object.prototype properties (such as toString), affecting all downstream objects in the application. The vulnerability is network-accessible and requires no authentication or user interaction. Exploitation can lead to application denial of service or unintended behavior modification. The vulnerability was patched in version 0.11.8, available at commit 4f0903fd7c832d12ccbe0d9c3d7e25d985e9e884.

## Affected products

- object-path object-path before 0.11.8

## Identifiers

- CVE-2021-3805
- GHSA-8v63-cqqc-6r2c

## Timeline

- 2021-09-20: disclosed: Published in GitHub Advisory Database
- 2021-09-20: patched: Fixed in version 0.11.8

## References

- [https://github.com/mariocasciaro/object-path/commit/4f0903fd7c832d12ccbe0d9c3d7e25d985e9e884](https://github.com/mariocasciaro/object-path/commit/4f0903fd7c832d12ccbe0d9c3d7e25d985e9e884)

## Related threats

- [npm object-path prototype pollution bypass](https://junglewise.ai/threats/cve-2021-23434-npm-object-path-prototype-pollution-bypass)
- [object-path prototype pollution in set() method](https://junglewise.ai/threats/cve-2020-15256-object-path-prototype-pollution-in-set-method)