CVE-2024-21529 Overview
CVE-2024-21529 is a prototype pollution vulnerability affecting versions of the dset npm package before 3.1.4. The flaw resides in the dset function, which fails to sanitize user-controlled input before assigning object properties. Attackers can inject the __proto__ property, which propagates recursively to all objects in the JavaScript runtime. The dset package is widely used across Node.js and browser applications for deep setting of object properties, expanding the potential attack surface. The vulnerability is tracked under CWE-1321 (Improperly Controlled Modification of Object Prototype Attributes).
Critical Impact
Remote attackers can pollute the JavaScript Object.prototype, enabling application logic tampering, denial of service, and in some contexts arbitrary code execution.
Affected Products
- dset npm package versions prior to 3.1.4
- Node.js applications that pass untrusted input to the dset function
- Browser and server-side JavaScript projects depending on vulnerable dset releases
Discovery Timeline
- 2024-09-11 - CVE-2024-21529 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2024-21529
Vulnerability Analysis
The dset package provides a lightweight utility for deep property assignment on JavaScript objects. Before version 3.1.4, the function traverses a key path and assigns values without filtering dangerous keys such as __proto__, constructor, or prototype. When an attacker controls the key path passed to dset, they can walk the prototype chain and modify Object.prototype. Every object subsequently created or accessed inherits the polluted properties. This can subvert authentication checks, coerce configuration values, or trigger unexpected behavior in downstream libraries that rely on default property lookups.
Root Cause
The root cause is missing input sanitization in the recursive key-assignment routine. The function accepts a dotted or array-based key path and iterates each segment, calling property assignment without validating that the segment is a safe own-property key. Because JavaScript treats __proto__ as a special accessor for the prototype, writing to it modifies the shared prototype object rather than the target instance.
Attack Vector
Exploitation requires an application to forward attacker-controlled data — typically from HTTP request bodies, query parameters, or JSON payloads — into a dset call as the key path. No authentication or user interaction is required when the vulnerable code is reachable over the network. Once the prototype is polluted, the effects persist for the lifetime of the Node.js process, and secondary gadgets in other libraries can escalate the pollution into denial of service or code execution.
See the upstream fix in the GitHub commit details and the Snyk vulnerability report for technical specifics.
Detection Methods for CVE-2024-21529
Indicators of Compromise
- HTTP requests containing __proto__, constructor.prototype, or prototype tokens in JSON keys, query strings, or URL paths.
- Unexpected properties appearing on objects that were never explicitly assigned, indicating prototype contamination.
- Application crashes or logic errors following ingestion of user-supplied nested JSON structures.
Detection Strategies
- Perform software composition analysis (SCA) across package.json and package-lock.json files to flag dset versions below 3.1.4.
- Instrument runtime hooks or use a JavaScript sandbox to alert when Object.prototype receives new properties at runtime.
- Deploy application-layer detections that inspect request payloads for prototype pollution key patterns.
Monitoring Recommendations
- Enable dependency scanning in CI/CD pipelines and fail builds that ship vulnerable dset versions.
- Forward Node.js application logs and web application firewall (WAF) events to a centralized analytics platform to correlate prototype pollution attempts.
- Track anomalous error rates or property-access exceptions that may indicate successful pollution.
How to Mitigate CVE-2024-21529
Immediate Actions Required
- Upgrade dset to version 3.1.4 or later across all direct and transitive dependencies.
- Audit application code for any location where untrusted input is passed as the key path argument to dset.
- Deploy WAF rules that block request payloads containing __proto__, constructor, or prototype keys where such input is not expected.
Patch Information
The maintainers addressed the flaw in dset version 3.1.4. The fix, published in commit 16d6154, rejects dangerous property names during key traversal. Consult the Snyk advisory for remediation guidance and version metadata.
Workarounds
- Freeze Object.prototype at process startup using Object.freeze(Object.prototype) to prevent modification.
- Validate and allowlist keys before invoking dset, explicitly rejecting __proto__, constructor, and prototype.
- Use Map objects or Object.create(null) for user-controlled key/value storage to eliminate prototype exposure.
# Upgrade the vulnerable package to the patched release
npm install dset@^3.1.4
npm audit --production
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
