Minimist <=1.2.5 is vulnerable to Prototype Pollution via file index.js, function setKey() (lines 69-95).
Priority MEDIUM 56CWE-1321Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Partial Red Hat: 20 fixed, 9 without a fix
Attack profile from CVSS 3.1 · NVD. Fix status from CNA, GitHub and Red Hat.
Summary
Minimist <=1.2.5 is vulnerable to Prototype Pollution via file index.js, function setKey() (lines 69-95).
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.04581 91st percentileScored 2026-11-07
Public exploit Yes 3 exploit referencesTagged by NVD
Fix Partial minimist (npm): 1.2.6, 0.2.4Red Hat: 22 advisoriesRed Hat: 20 fixed, 9 without a fix
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | — | all versions | — | No fix listed | CNA |
| — | minimist (npm) | 1.0.0 to before 1.2.6 | 1.2.6 | Patch available | GHSA-xvch-5gv4-984h |
| — | minimist (npm) | before 0.2.4 | 0.2.4 | Patch available | GHSA-xvch-5gv4-984h |
- — Vendor— Affected all versions Fixed in — No fix listed CNA
- minimist (npm) Vendor— Affected 1.0.0 to before 1.2.6 Fixed in 1.2.6 Patch available GHSA-xvch-5gv4-984h
- minimist (npm) Vendor— Affected before 0.2.4 Fixed in 0.2.4 Patch available GHSA-xvch-5gv4-984h
Remediation
- Fix · GHSA-xvch-5gv4-984h minimist (npm) Fixed in 1.2.6 Advisory →
- Fix · GHSA-xvch-5gv4-984h minimist (npm) Fixed in 0.2.4 Advisory →
Red Hat 22 advisories
- RHSA-2025:1747 Released 2025-02-24 · Red Hat rating CriticalRed Hat JBoss Enterprise Application Platform 7.3.12 security update
- Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7 Server eap7-hal-console-3.2.17-1.Final_redhat_00001.1.el7eap, eap7-jackson-annotations-2.10.4-2.redhat_00004.1.el7eap, eap7-jackson-core-2.10.4-2.redhat_00004.1.el7eap +38
- RHSA-2023:1742 Released 2023-04-12 · Red Hat rating Importantnodejs:14 security, bug fix, and enhancement update
- Red Hat Enterprise Linux AppStream EUS (v.8.6) nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64::nodejs:14, nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le::nodejs:14, nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x::nodejs:14 +19
- RHSA-2023:1533 Released 2023-03-30 · Red Hat rating Importantnodejs:14 security, bug fix, and enhancement update
- Red Hat Enterprise Linux AppStream EUS (v.8.4) nodejs-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.aarch64::nodejs:14, nodejs-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.ppc64le::nodejs:14, nodejs-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.s390x::nodejs:14 +19
Show 19 more Red Hat advisories
- RHSA-2023:1043 Released 2023-03-01 · Red Hat rating ImportantRed Hat Single Sign-On 7.6.2 security update on RHEL 7
- Red Hat Single Sign-On 7.6 for RHEL 7 Server rh-sso7-keycloak-18.0.6-1.redhat_00001.1.el7sso, rh-sso7-keycloak-server-18.0.6-1.redhat_00001.1.el7sso
- RHSA-2023:1049 Released 2023-03-01 · Red Hat rating ImportantRed Hat Single Sign-On 7.6.2 security update
- Red Hat Single Sign-On 7
- RHSA-2023:1047 Released 2023-03-01 · Red Hat rating ImportantRed Hat Single Sign-On 7.6.2 for OpenShift image security and enhancement update
- Middleware Containers for OpenShift rh-sso-7/sso76-openshift-rhel8
- RHSA-2023:1045 Released 2023-03-01 · Red Hat rating ImportantRed Hat Single Sign-On 7.6.2 security update on RHEL 9
- Red Hat Single Sign-On 7.6 for RHEL 9 rh-sso7-keycloak-18.0.6-1.redhat_00001.1.el9sso, rh-sso7-keycloak-server-18.0.6-1.redhat_00001.1.el9sso
- RHSA-2023:1044 Released 2023-03-01 · Red Hat rating ImportantRed Hat Single Sign-On 7.6.2 security update on RHEL 8
- Red Hat Single Sign-On 7.6 for RHEL 8 rh-sso7-keycloak-18.0.6-1.redhat_00001.1.el8sso, rh-sso7-keycloak-server-18.0.6-1.redhat_00001.1.el8sso
- RHSA-2023:0612 Released 2023-02-06 · Red Hat rating Moderaterh-nodejs14-nodejs and rh-nodejs14-nodejs-nodemon security update
- Red Hat Software Collections for RHEL Workstation(v. 7) rh-nodejs14-nodejs-14.21.1-3.el7, rh-nodejs14-nodejs-devel-14.21.1-3.el7, rh-nodejs14-nodejs-docs-14.21.1-3.el7 +3
- Red Hat Software Collections for RHEL(v. 7) rh-nodejs14-nodejs-14.21.1-3.el7, rh-nodejs14-nodejs-devel-14.21.1-3.el7, rh-nodejs14-nodejs-docs-14.21.1-3.el7 +3
- RHSA-2023:0321 Released 2023-01-23 · Red Hat rating Moderatenodejs and nodejs-nodemon security, bug fix, and enhancement update
- Red Hat Enterprise Linux AppStream (v. 9) nodejs-1:16.18.1-3.el9_1, nodejs-docs-1:16.18.1-3.el9_1, nodejs-full-i18n-1:16.18.1-3.el9_1 +3
- RHSA-2023:0050 Released 2023-01-09 · Red Hat rating Moderatenodejs:14 security, bug fix, and enhancement update
- Red Hat Enterprise Linux AppStream (v. 8) nodejs-1:14.21.1-2.module+el8.7.0+17528+a329cd47.aarch64::nodejs:14, nodejs-1:14.21.1-2.module+el8.7.0+17528+a329cd47.ppc64le::nodejs:14, nodejs-1:14.21.1-2.module+el8.7.0+17528+a329cd47.s390x::nodejs:14 +19
- RHSA-2022:9073 Released 2022-12-15 · Red Hat rating Moderatenodejs:16 security, bug fix, and enhancement update
- Red Hat Enterprise Linux AppStream (v. 8) nodejs-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.aarch64::nodejs:16, nodejs-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.ppc64le::nodejs:16, nodejs-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.s390x::nodejs:16 +19
- RHSA-2022:8652 Released 2022-11-28 · Red Hat rating ImportantRed Hat Fuse 7.11.1 release and security update
- Red Hat Fuse 7.11.1
- RHSA-2022:7044 Released 2022-10-19 · Red Hat rating Moderaterh-nodejs14-nodejs security update
- Red Hat Software Collections for RHEL Workstation(v. 7) rh-nodejs14-nodejs-14.20.1-2.el7, rh-nodejs14-nodejs-devel-14.20.1-2.el7, rh-nodejs14-nodejs-docs-14.20.1-2.el7 +1
- Red Hat Software Collections for RHEL(v. 7) rh-nodejs14-nodejs-14.20.1-2.el7, rh-nodejs14-nodejs-devel-14.20.1-2.el7, rh-nodejs14-nodejs-docs-14.20.1-2.el7 +1
- RHSA-2022:6813 Released 2022-10-05 · Red Hat rating ImportantRed Hat Process Automation Manager 7.13.1 security update
- RHPAM 7.13.1 async
- RHSA-2022:5069 Released 2022-08-10 · Red Hat rating ImportantOpenShift Container Platform 4.11.0 bug fix and security update
- Red Hat OpenShift Container Platform 4.11 openshift4/ose-alibaba-disk-csi-driver-operator-container-rhel8, openshift4/ose-alibaba-machine-controllers-rhel8, openshift4/ose-aws-ebs-csi-driver-rhel8 +47
- RHSA-2022:5928 Released 2022-08-08 · Red Hat rating ModerateRed Hat JBoss Enterprise Application Platform 7.4.6 Security update
- Red Hat JBoss Enterprise Application Platform com.google.code.gson.gson-2.8.9.redhat-00001.jar, io.netty.netty-codec-http-4.1.77.Final-redhat-00001.jar, org.jboss.hal.hal-console-3.3.13.Final-redhat-00001-resources.jar
- RHSA-2022:5894 Released 2022-08-03 · Red Hat rating ModerateRed Hat JBoss Enterprise Application Platform 7.4.6 Security update.
- Red Hat JBoss EAP 7.4 for RHEL 9 eap7-1-18.el9eap, eap7-FastInfoset-1.2.13-11.1.redhat_1.1.el9eap, eap7-activemq-artemis-2.16.0-9.redhat_00042.1.el9eap +47
- RHSA-2022:5892 Released 2022-08-03 · Red Hat rating ModerateRed Hat JBoss Enterprise Application Platform 7.4.6 Security update
- Red Hat JBoss EAP 7.4 for RHEL 7 Server eap7-gson-2.8.9-1.redhat_00001.1.el7eap, eap7-hal-console-3.3.13-1.Final_redhat_00001.1.el7eap, eap7-netty-4.1.77-1.Final_redhat_00001.1.el7eap +27
- RHSA-2022:5893 Released 2022-08-03 · Red Hat rating ModerateRed Hat JBoss Enterprise Application Platform 7.4.6 Security update
- Red Hat JBoss EAP 7.4 for RHEL 8 eap7-gson-2.8.9-1.redhat_00001.1.el8eap, eap7-hal-console-3.3.13-1.Final_redhat_00001.1.el8eap, eap7-netty-4.1.77-1.Final_redhat_00001.1.el8eap +27
- RHSA-2022:4914 Released 2022-06-06 · Red Hat rating Moderaterh-nodejs12-nodejs security, bug fix, and enhancement update
- Red Hat Software Collections for RHEL Workstation(v. 7) rh-nodejs12-nodejs-12.22.12-2.el7, rh-nodejs12-nodejs-devel-12.22.12-2.el7, rh-nodejs12-nodejs-docs-12.22.12-2.el7 +1
- Red Hat Software Collections for RHEL(v. 7) rh-nodejs12-nodejs-12.22.12-2.el7, rh-nodejs12-nodejs-devel-12.22.12-2.el7, rh-nodejs12-nodejs-docs-12.22.12-2.el7 +1
- RHSA-2022:1739 Released 2022-05-05 · Red Hat rating ModerateRed Hat OpenShift Service Mesh 2.1.2.1 containers security update
- OpenShift Service Mesh 2.1 openshift-service-mesh/kiali-rhel8
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Migration Toolkit for Containers | Affected | No fix yet |
| Red Hat 3scale API Management Platform 2 | Affected | No fix yet |
| Red Hat Enterprise Linux 8 | Affected | No fix planned: Out of support scope |
| Red Hat Fuse 7 | Affected | No fix planned: Will not fix |
| Red Hat OpenShift Container Platform 3.11 | Affected | No fix planned: Out of support scope |
| Red Hat OpenShift Container Platform 4 | Affected | No fix planned: Will not fix |
| Red Hat OpenShift GitOps | Affected | No fix yet |
| Red Hat Quay 3 | Affected | No fix planned: Will not fix |
| Red Hat Satellite 6 | Affected | No fix planned: Will not fix |
| Middleware Containers for OpenShift | Fixed | RHSA-2023:1047 |
| OpenShift Service Mesh 2.1 | Fixed | RHSA-2022:1739 |
| RHPAM 7.13.1 async | Fixed | RHSA-2022:6813 |
| Red Hat Enterprise Linux AppStream (v. 8) | Fixed | RHSA-2022:9073, RHSA-2023:0050 |
| Red Hat Enterprise Linux AppStream (v. 9) | Fixed | RHSA-2023:0321 |
| Red Hat Enterprise Linux AppStream EUS (v.8.4) | Fixed | RHSA-2023:1533 |
| Red Hat Enterprise Linux AppStream EUS (v.8.6) | Fixed | RHSA-2023:1742 |
| Red Hat Fuse 7.11.1 | Fixed | RHSA-2022:8652 |
| Red Hat JBoss EAP 7.4 for RHEL 7 Server | Fixed | RHSA-2022:5892 |
| Red Hat JBoss EAP 7.4 for RHEL 8 | Fixed | RHSA-2022:5893 |
| Red Hat JBoss EAP 7.4 for RHEL 9 | Fixed | RHSA-2022:5894 |
| Red Hat JBoss Enterprise Application Platform | Fixed | RHSA-2022:5928 |
| Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7 Server | Fixed | RHSA-2025:1747 |
| Red Hat OpenShift Container Platform 4.11 | Fixed | RHSA-2022:5069 |
| Red Hat Single Sign-On 7 | Fixed | RHSA-2023:1049 |
| Red Hat Single Sign-On 7.6 for RHEL 7 Server | Fixed | RHSA-2023:1043 |
| Red Hat Single Sign-On 7.6 for RHEL 8 | Fixed | RHSA-2023:1044 |
| Red Hat Single Sign-On 7.6 for RHEL 9 | Fixed | RHSA-2023:1045 |
| Red Hat Software Collections for RHEL Workstation(v. 7) | Fixed | RHSA-2022:4914, RHSA-2022:7044, RHSA-2023:0612 |
| Red Hat Software Collections for RHEL(v. 7) | Fixed | RHSA-2022:4914, RHSA-2022:7044, RHSA-2023:0612 |
Not affected: 10 products
- Logging Subsystem for Red Hat OpenShift
- OpenShift Service Mesh 2.1
- Red Hat JBoss EAP 7.4 for RHEL 7 Server
- Red Hat JBoss EAP 7.4 for RHEL 8
- Red Hat JBoss Enterprise Application Platform
- Red Hat JBoss Enterprise Application Platform Expansion Pack
- Red Hat OpenShift Container Platform 4
- Red Hat OpenShift Container Platform 4.11
- Red Hat Openshift Data Foundation 4
- Red Hat Virtualization 4
Timeline
- 2026-10-02 Threatist record created from CVE-2021-44906
- 2026-10-03 Alias added: GHSA-xvch-5gv4-984h
- 2026-10-08 CISA SSVC decision points changed
References
Exploit 3
Advisory 2
Other 10
- https://security.netapp.com/advisory/ntap-20240621-0006/
- https://github.com/minimistjs/minimist/issues/11
- https://github.com/minimistjs/minimist/pull/24
- https://github.com/minimistjs/minimist/commit/34e20b8461118608703d6485326abbb8e35e1703
- https://github.com/minimistjs/minimist/commit/bc8ecee43875261f4f17eb20b1243d3ed15e70eb
- https://github.com/minimistjs/minimist/commit/c2b981977fa834b223b408cfb860f933c9811e4d
- https://github.com/minimistjs/minimist/commit/ef9153fc52b6cea0744b2239921c5dcae4697f11
- https://github.com/minimistjs/minimist/commits/v0.2.4
- https://github.com/substack/minimist
- https://security.netapp.com/advisory/ntap-20240621-0006
More Substack Minimist vulnerabilities
- TI-2020-06120 Prototype pollution in minimist CVSS 3.1MEDIUM 5.6
Sources
- CVE-2021-44906 · CVE Program
- CVE-2021-44906 · NVD
- FIRST EPSS
- GHSA-xvch-5gv4-984h · GitHub Advisory Database · CC BY 4.0
- CVE-2021-44906 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences