Prototype pollution in NodeJS Node
Priority MEDIUM 55CWE-471Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- None · Low · High
- Fix status
- Partial Red Hat: 8 fixed, 1 without a fix
Attack profile from CVSS 3.1 · NVD. Fix status from CNA and Red Hat.
Summary
Due to the formatting logic of the "console.table()" function it was not safe to allow user controlled input to be passed to the "properties" parameter while simultaneously passing a plain object with at least one property as the first parameter, which could be "__proto__". The prototype pollution has very limited control, in that it only allows an empty string to be assigned to numerical keys of the object prototype.Node.js >= 12.22.9, >= 14.18.3, >= 16.13.2, and >= 17.3.1 use a null protoype for the object these properties are being assigned to.
Why it matters now
EPSS 0.21514 97th percentileScored 2026-11-07
Fix Partial Node (NodeJS): 12.22.9, 14.18.3, 16.13.2 +1Red Hat: 6 advisoriesRed Hat: 8 fixed, 1 without a fix
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| NodeJS | Node | 4.0 and later; 5.0 and later; 6.0 and later; 7.0 and later; 8.0 and later; 9.0 and later; 10.0 and later; 11.0 and later; 12.0 to before 12.22.9; 13.0 and later; 14.0 to before 14.18.3; 15.0 and later; 16.0 to before 16.13.2; 17.0 to before 17.3.1 | 12.22.9, 14.18.3, 16.13.2, 17.3.1 | Patch available | CNA |
- Node VendorNodeJS Affected 4.0 and later; 5.0 and later; 6.0 and later; 7.0 and later; 8.0 and later; 9.0 and later; 10.0 and later; 11.0 and later; 12.0 to before 12.22.9; 13.0 and later; 14.0 to before 14.18.3; 15.0 and later; 16.0 to before 16.13.2; 17.0 to before 17.3.1 Fixed in 12.22.9, 14.18.3, 16.13.2, 17.3.1 Patch available CNA
CPE configurations NVD · 14
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:nodejs:node.js:*:*:*:*:lts:*:*:* | 12.0.0 to before 12.22.9; 14.0.0 to before 14.18.3; 16.0.0 to before 16.13.2 | Vulnerable | NodeJS |
| cpe:2.3:a:nodejs:node.js:*:*:*:*:-:*:*:* | 17.0.0 to before 17.3.1 | Vulnerable | NodeJS |
| cpe:2.3:a:oracle:mysql_cluster:*:*:*:*:*:*:*:* | up to 8.0.29 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:mysql_connectors:*:*:*:*:*:*:*:* | up to 8.0.28 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:mysql_enterprise_monitor:*:*:*:*:*:*:*:* | up to 8.0.29 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:mysql_server:*:*:*:*:*:*:*:* | up to 8.0.29 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:mysql_workbench:*:*:*:*:*:*:*:* | up to 8.0.28 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.58:*:*:*:*:*:*:* | 8.58 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.59:*:*:*:*:*:*:* | 8.59 | Vulnerable | Oracle |
| cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:* | 10.0 | Vulnerable | Debian |
- cpe:2.3:a:nodejs:node.js:*:*:*:*:lts:*:*:* Versions 12.0.0 to before 12.22.9; 14.0.0 to before 14.18.3; 16.0.0 to before 16.13.2 Vulnerable ·NodeJS
- cpe:2.3:a:nodejs:node.js:*:*:*:*:-:*:*:* Versions 17.0.0 to before 17.3.1 Vulnerable ·NodeJS
- cpe:2.3:a:oracle:mysql_cluster:*:*:*:*:*:*:*:* Versions up to 8.0.29 Vulnerable ·Oracle
- cpe:2.3:a:oracle:mysql_connectors:*:*:*:*:*:*:*:* Versions up to 8.0.28 Vulnerable ·Oracle
- cpe:2.3:a:oracle:mysql_enterprise_monitor:*:*:*:*:*:*:*:* Versions up to 8.0.29 Vulnerable ·Oracle
- cpe:2.3:a:oracle:mysql_server:*:*:*:*:*:*:*:* Versions up to 8.0.29 Vulnerable ·Oracle
- cpe:2.3:a:oracle:mysql_workbench:*:*:*:*:*:*:*:* Versions up to 8.0.28 Vulnerable ·Oracle
- cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.58:*:*:*:*:*:*:* Versions 8.58 Vulnerable ·Oracle
- cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.59:*:*:*:*:*:*:* Versions 8.59 Vulnerable ·Oracle
- cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:* Versions 10.0 Vulnerable ·Debian
Show 4 more CPE
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:* | 11.0 | Vulnerable | Debian |
| cpe:2.3:a:netapp:oncommand_insight:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | NetApp |
| cpe:2.3:a:netapp:oncommand_workflow_automation:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | NetApp |
| cpe:2.3:a:netapp:snapcenter:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | NetApp |
- cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:* Versions 11.0 Vulnerable ·Debian
- cpe:2.3:a:netapp:oncommand_insight:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
- cpe:2.3:a:netapp:oncommand_workflow_automation:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
- cpe:2.3:a:netapp:snapcenter:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
Remediation
- Fix · CNA Node (NodeJS) Fixed in 12.22.9, 14.18.3, 16.13.2, 17.3.1
Red Hat 6 advisories
- RHSA-2023:3742 Released 2023-06-21 · Red Hat rating ImportantRed Hat OpenShift Data Foundation 4.13.0 security and bug fix update
- RHODF 4.13 for RHEL 9 odf4/cephcsi-rhel9, odf4/mcg-core-rhel9, odf4/mcg-rhel9-operator +7
- RHSA-2023:1742 Released 2023-04-12 · Red Hat rating Importantnodejs:14 security, bug fix, and enhancement update
- Red Hat Enterprise Linux AppStream EUS (v.8.6) nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64::nodejs:14, nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le::nodejs:14, nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x::nodejs:14 +19
- RHSA-2022:9073 Released 2022-12-15 · Red Hat rating Moderatenodejs:16 security, bug fix, and enhancement update
- Red Hat Enterprise Linux AppStream (v. 8) nodejs-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.aarch64::nodejs:16, nodejs-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.ppc64le::nodejs:16, nodejs-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.s390x::nodejs:16 +19
Show 3 more Red Hat advisories
- RHSA-2022:7830 Released 2022-11-08 · Red Hat rating Moderatenodejs:14 security update
- Red Hat Enterprise Linux AppStream (v. 8) nodejs-1:14.20.1-2.module+el8.7.0+16991+b0a68a3e.aarch64::nodejs:14, nodejs-1:14.20.1-2.module+el8.7.0+16991+b0a68a3e.ppc64le::nodejs:14, nodejs-1:14.20.1-2.module+el8.7.0+16991+b0a68a3e.s390x::nodejs:14 +19
- RHSA-2022:7044 Released 2022-10-19 · Red Hat rating Moderaterh-nodejs14-nodejs security update
- Red Hat Software Collections for RHEL Workstation(v. 7) rh-nodejs14-nodejs-14.20.1-2.el7, rh-nodejs14-nodejs-devel-14.20.1-2.el7, rh-nodejs14-nodejs-docs-14.20.1-2.el7 +1
- Red Hat Software Collections for RHEL(v. 7) rh-nodejs14-nodejs-14.20.1-2.el7, rh-nodejs14-nodejs-devel-14.20.1-2.el7, rh-nodejs14-nodejs-docs-14.20.1-2.el7 +1
- RHSA-2022:4914 Released 2022-06-06 · Red Hat rating Moderaterh-nodejs12-nodejs security, bug fix, and enhancement update
- Red Hat Software Collections for RHEL Workstation(v. 7) rh-nodejs12-nodejs-12.22.12-2.el7, rh-nodejs12-nodejs-devel-12.22.12-2.el7, rh-nodejs12-nodejs-docs-12.22.12-2.el7 +1
- Red Hat Software Collections for RHEL(v. 7) rh-nodejs12-nodejs-12.22.12-2.el7, rh-nodejs12-nodejs-devel-12.22.12-2.el7, rh-nodejs12-nodejs-docs-12.22.12-2.el7 +1
Fixed in the same release
Records fixed by the same vendor advisory or release, as the CNA lists them.
- Release ·
NodeJS Node 10.*, 11.* and 12 more versions
4 records Highest priority Priority MEDIUM 3 MEDIUM, 1 LOW
Other records, highest priority first
- TI-2021-20131 Improper certificate validation in NodeJS NodePriority MEDIUM 43
- TI-2021-20133 Improper certificate validation in NodeJS NodePriority MEDIUM 42
- TI-2021-20132 Improper certificate validation in NodeJS NodePriority LOW 37
Vendor assessments
Red Hat
Red Hat rating: Low. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat Quay 3 | Affected | No fix planned: Will not fix |
| RHODF 4.13 for RHEL 9 | Fixed | RHSA-2023:3742 |
| Red Hat Enterprise Linux AppStream (v. 8) | Fixed | RHSA-2022:7830, RHSA-2022:9073 |
| Red Hat Enterprise Linux AppStream E4S (v. 8.1) | Fixed | — |
| Red Hat Enterprise Linux AppStream EUS (v. 8.2) | Fixed | — |
| Red Hat Enterprise Linux AppStream EUS (v.8.4) | Fixed | — |
| Red Hat Enterprise Linux AppStream EUS (v.8.6) | Fixed | RHSA-2023:1742 |
| Red Hat Software Collections for RHEL Workstation(v. 7) | Fixed | RHSA-2022:4914, RHSA-2022:7044 |
| Red Hat Software Collections for RHEL(v. 7) | Fixed | RHSA-2022:4914, RHSA-2022:7044 |
Not affected: 2 products
- RHODF 4.13 for RHEL 9
- Red Hat Enterprise Linux 9
Timeline
- 2026-10-02 Threatist record created from CVE-2022-21824
- 2026-10-03 Alias added: GHSA-39wv-qjgj-4jxg
References
Advisory 7
- https://nodejs.org/en/blog/vulnerability/jan-2022-security-releases/
- https://hackerone.com/reports/1431042
- https://security.netapp.com/advisory/ntap-20220325-0007/
- DSA-5170
- https://www.oracle.com/security-alerts/cpujul2022.html
- https://security.netapp.com/advisory/ntap-20220729-0004/
- [debian-lts-announce] 20221005 [SECURITY] [DLA 3137-1] nodejs security update
More NodeJS Node.js vulnerabilities
- TI-2026-79288 Out-of-bounds write in Google Brotli decoder KEVCVSS 4.0CRITICAL 9.2
- TI-2023-23979 The HTTP/2 protocol allows a denial of service (server resource consumption) because… KEVCVSS 3.1HIGH 7.5
- TI-2016-01993 The DES and Triple DES ciphers, as used in the TLS, SSH, and IPSec protocols and other… CVSS 3.1HIGH 7.5
- TI-2024-03325 Command injection vulnerability in programing languages on Microsoft Windows operating system. CVSS 3.1CRITICAL 9.8
- TI-2022-03472 X.509 Email Address Variable Length Buffer Overflow CVSS 3.1HIGH 7.5
- TI-2022-03315 X.509 Email Address 4-byte Buffer Overflow CVSS 3.1HIGH 7.5
Sources
- CVE-2022-21824 · CVE Program
- CVE-2022-21824 · NVD
- FIRST EPSS
- GHSA-39wv-qjgj-4jxg · GitHub Advisory Database · CC BY 4.0
- CVE-2022-21824 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences