CVE-2022-21824

HIGH
8.2
CVSS Score
Published: February 24, 2022 at 12:00 AM UTC
Updated: June 17, 2026 at 04:27 AM UTC
11 products affected across 4 vendorsDebian LinuxMySQL ServerOnCommand Insight

Using Node by NodeJS?

Get instant alerts when new vulnerabilities affect Node - before attackers find them.

Real-time alertsTrack your software stackFree plan available
Severity
HIGH8.2
Exploit prediction
EPSS 22%

Description

Due to the formatting logic of the "console.table()" function it was not safe to allow user controlled input to be passed to the "properties" parameter while simultaneously passing a plain object with at least one property as the first parameter, which could be "__proto__". The prototype pollution has very limited control, in that it only allows an empty string to be assigned to numerical keys of the object prototype.Node.js >= 12.22.9, >= 14.18.3, >= 16.13.2, and >= 17.3.1 use a null protoype for the object these properties are being assigned to.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

All versions
All versions
10.0 ≤ v < 10.*11.0 ≤ v < 11.*12.0 ≤ v < 12.22.912.0.0 ≤ v < 12.22.913.0 ≤ v < 13.*14.0 ≤ v < 14.18.314.0.0 ≤ v < 14.18.315.0 ≤ v < 15.*16.0 ≤ v < 16.13.216.0.0 ≤ v < 16.13.217.0 ≤ v < 17.3.117.0.0 ≤ v < 17.3.14.0 ≤ v < 4.*5.0 ≤ v < 5.*6.0 ≤ v < 6.*7.0 ≤ v < 7.*8.0 ≤ v < 8.*9.0 ≤ v < 9.*10.011.012.013.014.015.016.017.04.05.06.07.08.09.0
Affected range stops below 10.*, so it looks safe — our inference, not a vendor statement
Affected range stops below 11.*, so it looks safe — our inference, not a vendor statement
Affected range stops below 12.22.9, so it looks safe — our inference, not a vendor statement
Affected range stops below 13.*, so it looks safe — our inference, not a vendor statement
Affected range stops below 14.18.3, so it looks safe — our inference, not a vendor statement
Affected range stops below 15.*, so it looks safe — our inference, not a vendor statement
Affected range stops below 16.13.2, so it looks safe — our inference, not a vendor statement
Affected range stops below 17.3.1, so it looks safe — our inference, not a vendor statement
Affected range stops below 4.*, so it looks safe — our inference, not a vendor statement
Affected range stops below 5.*, so it looks safe — our inference, not a vendor statement
Affected range stops below 6.*, so it looks safe — our inference, not a vendor statement
Affected range stops below 7.*, so it looks safe — our inference, not a vendor statement
Affected range stops below 8.*, so it looks safe — our inference, not a vendor statement
Affected range stops below 9.*, so it looks safe — our inference, not a vendor statement
v ≤ 8.0.29
v ≤ 8.0.29

Remediation

No guide yet

No remediation guidance has been written for this CVE yet. What the record does show:

CVSS

Attack Vector
NETWORK
Complexity
LOW
Privileges
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality
NONE
Integrity
LOW
Availability
HIGH
Vector?

Quick Info

StatusMODIFIED
CWE
CWE-471CWE-1321

Get alerted

Stop reading CVE feeds looking for your own stack

Track the products you run and VulnTracker tells you when a new CVE affects them — with what is known about fixing it, and nothing about the rest.

Free plan, no card