TI-2022-06175 Aliases CVE-2022-21803 GHSA-6xwr-q98w-rvg7

Prototype pollution in nconf

LOW 36CWE-1321Published 2022-04-12 · Updated 2024-09-16

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Impact type: —
Confidentiality · integrity · availability: None · High · None
Fix status: Partial Red Hat: 1 without a fix

Attack profile from CVSS 3.1 · NVD. Fix status from CNA, GitHub and Red Hat.

Summary

This affects the package nconf before 0.11.4. When using the memory engine, it is possible to store a nested JSON representation of the configuration. The .set() function, that is responsible for setting the configuration properties, is vulnerable to Prototype Pollution. By providing a crafted property, it is possible to modify the properties on the Object.prototype.

Why it matters now

EPSS 0.0178 78th percentileScored 2026-11-07

Fix Partial nconf: 0.11.4nconf (npm): 0.11.4Red Hat: 3 advisoriesRed Hat: 1 without a fix

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
—	nconf	before 0.11.4	0.11.4	Patch available	CNA
—	nconf (npm)	before 0.11.4	0.11.4	Patch available	GHSA-6xwr-q98w-rvg7

nconf Vendor— Affected before 0.11.4 Fixed in 0.11.4 Patch available CNA
nconf (npm) Vendor— Affected before 0.11.4 Fixed in 0.11.4 Patch available GHSA-6xwr-q98w-rvg7

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:nconf_project:nconf::::::node.js::*	before 0.11.4	Vulnerable	Nconf Project

cpe:2.3:a:nconf_project:nconf:*:*:*:*:*:node.js:*:* Versions before 0.11.4 Vulnerable ·Nconf Project

Remediation

Fix · CNA nconf Fixed in 0.11.4
Fix · GHSA-6xwr-q98w-rvg7 nconf (npm) Fixed in 0.11.4 Advisory →

Red Hat 3 advisories

RHSA-2022:5201 Released 2022-06-27 · Red Hat rating Moderate
Red Hat Advanced Cluster Management 2.4.5 security updates and bug fixes
- Red Hat Advanced Cluster Management for Kubernetes 2.4 for RHEL 8 rhacm2/acm-grafana-rhel8, rhacm2/acm-must-gather-rhel8, rhacm2/acm-operator-bundle +47
RHSA-2022:4956 Released 2022-06-09 · Red Hat rating Important
Red Hat Advanced Cluster Management 2.5 security updates, images, and bug fixes
- Red Hat Advanced Cluster Management for Kubernetes 2.5 for RHEL 8 rhacm2/acm-cluster-proxy-rhel8, rhacm2/acm-governance-policy-addon-controller-rhel8, rhacm2/acm-grafana-rhel8 +47
RHSA-2022:1681 Released 2022-05-03 · Red Hat rating Moderate
Red Hat Advanced Cluster Management 2.4.4 security updates and bug fixes
- Red Hat Advanced Cluster Management for Kubernetes 2.4 for RHEL 8 rhacm2/acm-grafana-rhel8, rhacm2/acm-must-gather-rhel8, rhacm2/acm-operator-bundle +47

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

Product	Status	Plan or fix
Red Hat Advanced Cluster Management for Kubernetes 2	Affected	No fix yet

Timeline

2026-10-02 Threatist record created from CVE-2022-21803
2026-10-03 Alias added: GHSA-6xwr-q98w-rvg7

References

Patch 1

https://github.com/indexzero/nconf/pull/397

Advisory 2

Other 1

https://github.com/indexzero/nconf

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences