Read the docs
TI-2022-09040 Aliases CVE-2022-25352GHSA-x5m8-2r8v-8f97

Prototype pollution in libnested

Priority MEDIUM 46CWE-1321Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub.

Summary

The package libnested before 1.5.2 are vulnerable to Prototype Pollution via the set function in index.js. **Note:** This vulnerability derives from an incomplete fix for [CVE-2020-28283](https://security.snyk.io/vuln/SNYK-JS-LIBNESTED-1054930)

Why it matters now

EPSS 0.02061 81st percentileScored 2026-11-07
Fix Fixed libnested: 1.5.2libnested (npm): 1.5.2

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
—libnestedbefore 1.5.21.5.2Patch availableCNA
—libnested (npm)before 1.5.21.5.2Patch availableGHSA-x5m8-2r8v-8f97
  • libnested Vendor— Affected before 1.5.2 Fixed in 1.5.2 Patch available CNA
  • libnested (npm) Vendor— Affected before 1.5.2 Fixed in 1.5.2 Patch available GHSA-x5m8-2r8v-8f97

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:libnested_project:libnested:*:*:*:*:*:node.js:*:*before 1.5.2VulnerableLibnested Project
  • cpe:2.3:a:libnested_project:libnested:*:*:*:*:*:node.js:*:* Versions before 1.5.2 Vulnerable ·Libnested Project

Remediation

  • Fix · CNA libnested Fixed in 1.5.2
  • Fix · GHSA-x5m8-2r8v-8f97 libnested (npm) Fixed in 1.5.2 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2022-25352
  2. 2026-10-03 Alias added: GHSA-x5m8-2r8v-8f97

References

Patch 1

Advisory 1

Other 2

  • TI-2020-17176 Prototype pollution vulnerability in 'libnested' versions 0.0.0 through 1.5.0 allows an… CVSS 3.1CRITICAL 9.8

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences