CVE-2021-44906
published 2022-03-17CVE-2021-44906: Minimist <=1.2.5 is vulnerable to Prototype Pollution via file index.js, function setKey() (lines 69-95).
PriorityP351critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
EPSS
4.58%
90.7th percentile
Minimist <=1.2.5 is vulnerable to Prototype Pollution via file index.js, function setKey() (lines 69-95).
Affected
4 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | node-minimist | < node-minimist 1.2.6+~cs5.3.2-1 (bookworm) | node-minimist 1.2.6+~cs5.3.2-1 (bookworm) |
| substack | minimist | < 1.2.6 | 1.2.6 |
| substack | minimist | >= 0 < 0.2.4 | 0.2.4 |
| substack | minimist | >= 1.0.0 < 1.2.6 | 1.2.6 |
CVSS provenance
nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvdv2.07.5HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P
osv9.8CRITICAL
vendor_debian9.8CRITICAL
vendor_redhat5.6MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
Prototype Pollution in minimist
ghsa·2022-03-18
CVE-2021-44906 [CRITICAL] CWE-1321 Prototype Pollution in minimist
Prototype Pollution in minimist
Minimist prior to 1.2.6 and 0.2.4 is vulnerable to Prototype Pollution via file `index.js`, function `setKey()` (lines 69-95).
OSV
Prototype Pollution in minimist
osv·2022-03-18
CVE-2021-44906 [CRITICAL] Prototype Pollution in minimist
Prototype Pollution in minimist
Minimist prior to 1.2.6 and 0.2.4 is vulnerable to Prototype Pollution via file `index.js`, function `setKey()` (lines 69-95).
OSV
CVE-2021-44906: Minimist <=1
osv·2022-03-17·CVSS 9.8
CVE-2021-44906 [CRITICAL] CVE-2021-44906: Minimist <=1
Minimist <=1.2.5 is vulnerable to Prototype Pollution via file index.js, function setKey() (lines 69-95).
Red Hat
minimist: prototype pollution
vendor_redhat·2022-03-10·CVSS 5.6
CVE-2021-44906 [MEDIUM] CWE-1321 minimist: prototype pollution
minimist: prototype pollution
Minimist <=1.2.5 is vulnerable to Prototype Pollution via file index.js, function setKey() (lines 69-95).
An Uncontrolled Resource Consumption flaw was found in minimist. The original fix for CVE-2020-7598 was incomplete as it was still possible to bypass in some cases. This flaw (CVE-2021-44906) allows an attacker to trick the library into adding or modifying the properties of Object.prototype, using a constructor or __proto__ payload, resulting in prototype pollution and loss of confidentiality, availability, and integrity.
Statement: As minimist is an argument parsing module for nodejs, exploitation of this vulnerability requires an attacker to influence which arguments are passed to nodejs when running a script. Red Hat products and services are designe
Debian
CVE-2021-44906: node-minimist - Minimist <=1.2.5 is vulnerable to Prototype Pollution via file index.js, functio...
vendor_debian·2021·CVSS 9.8
CVE-2021-44906 [CRITICAL] CVE-2021-44906: node-minimist - Minimist <=1.2.5 is vulnerable to Prototype Pollution via file index.js, functio...
Minimist <=1.2.5 is vulnerable to Prototype Pollution via file index.js, function setKey() (lines 69-95).
Scope: local
bookworm: resolved (fixed in 1.2.6+~cs5.3.2-1)
bullseye: resolved (fixed in 1.2.5+~cs5.3.1-2+deb11u1)
forky: resolved (fixed in 1.2.6+~cs5.3.2-1)
sid: resolved (fixed in 1.2.6+~cs5.3.2-1)
trixie: resolved (fixed in 1.2.6+~cs5.3.2-1)
No detection rules found.
No public exploits indexed.
arXiv
The Hidden Dangers of Public Serverless Repositories: An Empirical Security Assessment
arxiv_fulltext·2025-10-20
The Hidden Dangers of Public Serverless Repositories: An Empirical Security Assessment
The Hidden Dangers of Public Serverless Repositories: An Empirical Security Assessment
The Hidden Dangers of Public Serverless Repositories
Eduard Marin1( )
Jinwoo Kim2
Alessio Pavoni1
Mauro Conti3,4
Roberto Di Pietro5
E.\ Marin et al.
Telefonica Research, Spain
\eduard.marinfabregas, alessio.pavoni\@telefonica.com
Kwangwoon University, Republic of Korea
[email protected]
University of Padua, Italy
[email protected]
Örebro University, Sweden
King Abdullah University of Science and Technology, Saudi Arabia
[email protected]
## Abstract
Serverless computing has rapidly emerged as a prominent cloud paradigm, enabling developers to focus solely on application logic without the burden of managing servers or underlying infrastructure. Public serverless repositories
Bugzilla
CVE-2021-44906 minimist: prototype pollution
bugzilla·2022-03-19·CVSS 9.8
CVE-2021-44906 [CRITICAL] CVE-2021-44906 minimist: prototype pollution
CVE-2021-44906 minimist: prototype pollution
Affected versions of minimist ( @[email protected] since you have changed the rating back to medium, are you
> going to update also the trackers?
Oh, they were updates, I have just not noticed. Thx and sorry for the noise
---
Vit, after getting strong reactions from a number of sources (including customers) I realized just how a terrible choice I had made. Worked with my team on writing a justification then restored the impact rating. My apologies to engineering for all the chaos and extra spam that I caused. Your initial question was valid, no worries!
---
(In reply to Nick Tait from comment #44)
No need for apologies. Thank you for your hard work.
---
This issue has been addressed in the following products:
Red Hat Software Collections
https://github.com/Marynk/JavaScript-vulnerability-detection/blob/main/minimist%20PoC.ziphttps://github.com/substack/minimist/blob/master/index.js#L69https://github.com/substack/minimist/issues/164https://security.netapp.com/advisory/ntap-20240621-0006/https://snyk.io/vuln/SNYK-JS-MINIMIST-559764https://stackoverflow.com/questions/8588563/adding-custom-properties-to-a-function/20278068#20278068https://github.com/Marynk/JavaScript-vulnerability-detection/blob/main/minimist%20PoC.ziphttps://github.com/substack/minimist/blob/master/index.js#L69https://github.com/substack/minimist/issues/164https://security.netapp.com/advisory/ntap-20240621-0006/https://snyk.io/vuln/SNYK-JS-MINIMIST-559764https://stackoverflow.com/questions/8588563/adding-custom-properties-to-a-function/20278068#20278068
2022-03-17
Published