npm package report

Is async safe?

1 known vulnerability, worst severity HIGH.

cvss

7.5

how bad it is if exploited, out of 10

epss

3.3%

chance of exploitation in the next 30 days

xyz score

5.0

CyberXYZ composite, out of 10

fig. 01 — GHSA-fwr7-v2mv-hh25, the advisory selected below

// advisories

GHSA-fwr7-v2mv-hh25

HIGHCVE-2021-43138

A vulnerability exists in Async through 3.2.1 for 3.x and through 2.6.3 for 2.x (fixed in 3.2.2 and 2.6.4), which could let a malicious user obtain privileges via the mapValues() method.

Affected: >= 2.0.0, < 2.6.4, >= 3.0.0, < 3.2.2
Fixed in: 2.6.4
Weakness: CWE-1321
Published: 2022-04-07
Source: github

GHSA NVD MITRE reference reference reference reference reference reference reference reference reference

// dependencies

3 direct, 3 carrying known advisories, worst CRITICAL

// ai model usage

Tracked for PyPI packages. HuggingFace models declare Python dependencies, so npm packages are not covered.

Checked 2026-09-22 at 02:33 UTC. The most recent advisory here was published 2022-04-07. Updated continuously from NVD, GHSA, OSV and CNA feeds.

Is async safe? npm package security report | CyberXYZ