# CVE-2021-4279: Starcounter-Jack JSON-Patch prototype pollution

Source: https://junglewise.ai/threats/cve-2021-4279-starcounter-jack-json-patch-prototype-pollution  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2022-12-25. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2021-4279 · Severity: low · CVSS 3.1 · Published 2022-12-25

JSON-Patch is a JavaScript library used to apply changes to JSON documents programmatically. A prototype pollution vulnerability allows attackers to modify the prototype chain of JavaScript objects, potentially corrupting shared object properties across an application. This could enable attackers to bypass security checks, inject malicious code, or cause unexpected application behavior without requiring authentication or user interaction.

Technologies: [Starcounter-Jack JSON-Patch](https://junglewise.ai/threats/technologies/json-patch). Vendors: [npm](https://junglewise.ai/threats/vendors/npm), [Starcounter-Jack](https://junglewise.ai/threats/vendors/starcounter-jack).

## Quick answers

**Is CVE-2021-4279 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2021-4279 being exploited in the wild.

**How severe is CVE-2021-4279?** Low severity, with a CVSS score of 3.1, published 25 December 2022.

**Which products and versions are affected?** fast-json-patch (npm) SEMVER:introduced=0,fixed=3.1.1; Starcounter-Jack JSON-Patch up to 3.1.0.

**Is there a fix for CVE-2021-4279?** Yes. fast-json-patch (npm): upgrade to 3.1.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2021-4279 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2021-4279?** Check whether you run fast-json-patch (npm) or Starcounter-Jack JSON-Patch at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- fast-json-patch (npm): upgrade to 3.1.1 or later

  ```sh
  npm install fast-json-patch@3.1.1
  ```


## Technical details

The vulnerability is a prototype pollution flaw (CWE-1321) in JSON-Patch versions up to 3.1.0 that allows improperly controlled modification of object prototype attributes. The vulnerability is triggered through malicious JSON-Patch operations that manipulate the object prototype chain. The attack vector is network-based with no authentication or user interaction required (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L). An attacker can achieve confidentiality, integrity, and availability impacts by poisoning shared prototype objects. The issue was patched in version 3.1.1 via commit 7ad6af41eabb2d799f698740a91284d762c955c9.

## Affected products

- Starcounter-Jack JSON-Patch up to 3.1.0

## Identifiers

- CVE-2021-4279
- GHSA-8gh8-hqwg-xf34

## Timeline

- 2022-12-25: disclosed
- 2021-08-13: patched: Fix merged to master

## References

- [https://github.com/Starcounter-Jack/JSON-Patch/pull/262](https://github.com/Starcounter-Jack/JSON-Patch/pull/262)