CVE-2022-21824
- State
- Published
- Severity
- Not scored
- Published
- Feb 24, 2022
- Updated
- Apr 30, 2025
- Reserved
- Dec 10, 2021
Description
Due to the formatting logic of the "console.table()" function it was not safe to allow user controlled input to be passed to the "properties" parameter while simultaneously passing a plain object with at least one property as the first parameter, which could be "__proto__". The prototype pollution has very limited control, in that it only allows an empty string to be assigned to numerical keys of the object prototype.Node.js >= 12.22.9, >= 14.18.3, >= 16.13.2, and >= 17.3.1 use a null protoype for the object these properties are being assigned to.
Scores
The record has no CVSS score.
Weaknesses
- CWE-471 Modification of Assumed-Immutable Data (MAID) (CWE-471)
Affected Products
| Product | Versions |
|---|---|
NodeNodeJS |
|
References
- https://nodejs.org/en/blog/vulnerability/jan-2022-security-releases/
- https://hackerone.com/reports/1431042
- https://www.oracle.com/security-alerts/cpuapr2022.html
- https://security.netapp.com/advisory/ntap-20220325-0007/
- DSA-5170vendor-advisory
- https://www.oracle.com/security-alerts/cpujul2022.html
- https://security.netapp.com/advisory/ntap-20220729-0004/
- [debian-lts-announce] 20221005 [SECURITY] [DLA 3137-1] nodejs security updatemailing-list
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.