CVE-2021-23413: 
JavaScript vulnerability analysis and mitigation

CVE-2021-23413 affects the JSZip package versions before 3.7.0. The vulnerability was discovered and disclosed on April 18, 2021, and published on July 25, 2021. The vulnerability impacts applications using JSZip for handling ZIP files (NVD, CVE).

The vulnerability occurs when crafting a new zip file with filenames set to Object prototype values (e.g., proto, toString, etc.), which results in a returned object with a modified prototype instance. This is a prototype pollution vulnerability that could lead to denial of service conditions. The vulnerability has a CVSS v3.1 base score of 5.3 (Medium severity) (Snyk).

The vulnerability can lead to Denial of Service (DoS) conditions where performance is reduced or there are interruptions in resource availability. While repeated exploitation is possible, the attacker cannot completely deny service to legitimate users. The resources remain partially available or fully available intermittently (Snyk).

The recommended mitigation is to upgrade JSZip to version 3.7.0 or higher. The fix involves using a null prototype object for the files property to prevent filenames from overriding object methods that would exist on a normal object (GitHub PR).