Read the docs
TI-2024-14284 Aliases CVE-2024-21528GHSA-g974-hxvm-x689

Prototype pollution in node-gettext

Priority LOW 27CWE-1321Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
High
Impact type
—
Confidentiality · integrity · availability
None · None · High
Fix status
Partial Red Hat: 4 fixed, 3 without a fix

Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub and Red Hat.

Summary

All versions of the package node-gettext are vulnerable to Prototype Pollution via the addTranslations() function in gettext.js due to improper user input sanitization.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00567 47th percentileScored 2026-11-07
Fix Partial Red Hat: 4 advisoriesRed Hat: 4 fixed, 3 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
—node-gettextall versions—No fix listedCNA
—node-gettext (npm)up to 3.0.0—No fix listedGHSA-g974-hxvm-x689
  • node-gettext Vendor— Affected all versions Fixed in — No fix listed CNA
  • node-gettext (npm) Vendor— Affected up to 3.0.0 Fixed in — No fix listed GHSA-g974-hxvm-x689

Remediation

Red Hat 4 advisories

  • RHSA-2025:2652 Released 2025-03-11 · Red Hat rating Important
    RHODF-4.18-RHEL-9 enhancement, bug fix and security update
    • RHODF 4.18 for RHEL 9 odf4/cephcsi-rhel9, odf4/ocs-client-console-rhel9, odf4/ocs-metrics-exporter-rhel9 +3
  • RHSA-2025:1865 Released 2025-02-26 · Red Hat rating Important
    RHODF-4.15-RHEL-9 security update
    • RHODF 4.15 for RHEL 9 odf4/ocs-client-console-rhel9, odf4/ocs-metrics-exporter-rhel9, odf4/ocs-rhel9-operator +4
  • RHSA-2025:1829 Released 2025-02-25 · Red Hat rating Important
    RHODF-4.16-RHEL-9 security update
    • RHODF 4.16 for RHEL 9 odf4/cephcsi-rhel9, odf4/ocs-client-console-rhel9, odf4/ocs-rhel9-operator +5
Show 1 more Red Hat advisories
  • RHSA-2025:1824 Released 2025-02-25 · Red Hat rating Important
    RHODF-4.17-RHEL-9 security update
    • RHODF 4.17 for RHEL 9 odf4/cephcsi-rhel9, odf4/ocs-client-console-rhel9, odf4/odf-cli-rhel9 +3

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat OpenShift Container Platform 4AffectedNo fix planned: Will not fix
Red Hat OpenShift Virtualization 4AffectedNo fix yet
Red Hat Openshift Data Foundation 4AffectedNo fix planned: Will not fix
RHODF 4.15 for RHEL 9Fixed RHSA-2025:1865
RHODF 4.16 for RHEL 9Fixed RHSA-2025:1829
RHODF 4.17 for RHEL 9Fixed RHSA-2025:1824
RHODF 4.18 for RHEL 9Fixed RHSA-2025:2652
Not affected: 4 products
  • RHODF 4.15 for RHEL 9
  • RHODF 4.16 for RHEL 9
  • RHODF 4.17 for RHEL 9
  • RHODF 4.18 for RHEL 9

Timeline

  1. 2026-10-02 Threatist record created from CVE-2024-21528
  2. 2026-10-03 Alias added: GHSA-g974-hxvm-x689

References

Advisory 1

Other 3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences