CVE-2021-28860: 
JavaScript vulnerability analysis and mitigation

In Node.js mixme, prior to v0.5.1, a vulnerability was discovered that allows attackers to add or alter properties of an object via 'proto' through the mutate() and merge() functions. The vulnerability was disclosed in May 2021 and affects the mixme package, a Node.js library (GitHub Advisory, NVD).

The vulnerability is classified as a prototype pollution issue (CWE-1321) with a CVSS v3.1 base score of 9.1 CRITICAL (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H). The vulnerability exists in the mutate() and merge() functions where the polluted attribute can be directly assigned to every object in the program through the 'proto' property manipulation (NVD).

When successfully exploited, this vulnerability could lead to addition or modification of data or cause a Denial of Service (DoS). The polluted attribute would be directly assigned to every object in the program, putting the availability of the program at risk (NetApp Advisory).

The vulnerability was patched in version 0.5.1 of the mixme package. Users are advised to upgrade to this version or later to address the security issue. No workarounds were provided for users unable to upgrade (GitHub Advisory).