CVE catalog

CVE-2021-44906

node-minimist: CVE-2021-44906

[CVE catalog]

Severity
Critical · CVSS 9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Published
Source
[NVD] · [CVE record]
EPSS
4.58% · Oct 25, 2026

Minimist <=1.2.5 is vulnerable to Prototype Pollution via file index.js, function setKey() (lines 69-95).

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debiannode-minimistsid1.2.8+~cs5.3.5-4fixed
Debiannode-minimistforky1.2.8+~cs5.3.5-4fixed
Debiannode-minimisttrixie1.2.8+~cs5.3.5-1fixed
Debiannode-minimistbookworm1.2.7+~cs5.3.2-2fixed
NpmminimistNot reported1.2.6fixed
NpmminimistNot reported0.2.4fixed
CpeminimistNot reported1.2.6fixed
Suserelease-notes-susemanager-proxymanager proxy 4.24.2.7-150300.3.31.2fixed
Suserelease-notes-susemanager-proxymanager retail branch server 4.24.2.7-150300.3.31.2fixed
Suserelease-notes-susemanagermanager server 4.24.2.7-150300.3.44.1fixed
Opensusenodejs8leap 15.38.17.0-150200.10.22.1fixed
Opensusenodejs8leap 15.48.17.0-150200.10.22.1fixed
Susenodejs12linux enterprise module for web and scripting 1212.22.12-1.48.1fixed
Susenodejs14linux enterprise module for web and scripting 15 sp314.19.1-150200.15.31.1fixed
Susenodejs14linux enterprise high performance computing 15 sp2-espos14.19.1-150200.15.31.1fixed
Susenodejs14linux enterprise high performance computing 15 sp2-ltss14.19.1-150200.15.31.1fixed
Susenodejs14linux enterprise server 15 sp2-bcl14.19.1-150200.15.31.1fixed
Susenodejs14linux enterprise server 15 sp2-ltss14.19.1-150200.15.31.1fixed
Susenodejs14linux enterprise server for sap applications 15 sp214.19.1-150200.15.31.1fixed
Susenodejs14manager proxy 4.114.19.1-150200.15.31.1fixed
Susenodejs14manager retail branch server 4.114.19.1-150200.15.31.1fixed
Susenodejs14manager server 4.114.19.1-150200.15.31.1fixed
Susenodejs14enterprise storage 714.19.1-150200.15.31.1fixed
Opensusenodejs14leap 15.314.19.1-150200.15.31.1fixed
Opensusenodejs14leap 15.414.19.1-150200.15.31.1fixed
Susenodejs14linux enterprise module for web and scripting 1214.19.1-6.28.1fixed
Susespacecmdmanager proxy module 4.24.2.17-150300.4.21.4fixed
Susespacewalk-backendmanager proxy module 4.24.2.22-150300.4.23.1fixed
Susespacewalk-certs-toolsmanager proxy module 4.24.2.16-150300.3.18.3fixed
Susespacewalk-webmanager proxy module 4.24.2.27-150300.3.21.7fixed
Susesupportutils-plugin-saltmanager proxy module 4.21.2.0-150300.3.3.1fixed
Suseinter-server-syncmanager server module 4.20.2.2-150300.8.17.1fixed
Suseprometheus-formulamanager server module 4.20.6.2-150300.3.14.1fixed
Susesalt-netapi-clientmanager server module 4.20.19.0-150300.3.6.1fixed
Susesmdbamanager server module 4.21.7.10-0.150300.3.6.1fixed
Susespacecmdmanager server module 4.24.2.17-150300.4.21.4fixed
Susespacewalk-backendmanager server module 4.24.2.22-150300.4.23.1fixed
Susespacewalk-certs-toolsmanager server module 4.24.2.16-150300.3.18.3fixed
Susespacewalk-javamanager server module 4.24.2.38-150300.3.35.1fixed
Susespacewalk-utilsmanager server module 4.24.2.16-150300.3.15.5fixed
Susespacewalk-webmanager server module 4.24.2.27-150300.3.21.7fixed
Susesupportutils-plugin-saltmanager server module 4.21.2.0-150300.3.3.1fixed
Susesusemanagermanager server module 4.24.2.32-150300.3.31.1fixed
Susesusemanager-doc-indexesmanager server module 4.24.2-150300.12.27.6fixed
Susesusemanager-docs_enmanager server module 4.24.2-150300.12.27.1fixed
Susesusemanager-schemamanager server module 4.24.2.22-150300.3.21.6fixed
Susesusemanager-slsmanager server module 4.24.2.23-150300.3.25.4fixed
Susesusemanager-sync-datamanager server module 4.24.2.12-150300.3.18.3fixed
Susevirtual-host-gatherermanager server module 4.21.0.23-150300.3.3.1fixed
Susenodejs12linux enterprise module for web and scripting 15 sp312.22.12-150200.4.32.1fixed
Susenodejs12linux enterprise high performance computing 15 sp2-espos12.22.12-150200.4.32.1fixed
Susenodejs12linux enterprise high performance computing 15 sp2-ltss12.22.12-150200.4.32.1fixed
Susenodejs12linux enterprise server 15 sp2-bcl12.22.12-150200.4.32.1fixed
Susenodejs12linux enterprise server 15 sp2-ltss12.22.12-150200.4.32.1fixed
Susenodejs12linux enterprise server for sap applications 15 sp212.22.12-150200.4.32.1fixed
Susenodejs12manager proxy 4.112.22.12-150200.4.32.1fixed
Susenodejs12manager retail branch server 4.112.22.12-150200.4.32.1fixed
Susenodejs12manager server 4.112.22.12-150200.4.32.1fixed
Susenodejs12enterprise storage 712.22.12-150200.4.32.1fixed
Opensusenodejs12leap 15.312.22.12-150200.4.32.1fixed
Opensusenodejs12leap 15.412.22.12-150200.4.32.1fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debiannode-minimistsourcesid1.2.6+~cs5.3.2-1not yet assignedNot reportedNot reported
Debiannode-minimistsourceforky1.2.6+~cs5.3.2-1not yet assignedNot reportedNot reported
Debiannode-minimistsourcetrixie1.2.6+~cs5.3.2-1not yet assignedNot reportedNot reported
Debiannode-minimistsourcebookworm1.2.6+~cs5.3.2-1not yet assignedNot reportedNot reported
NpmminimistnpmNot reported1.2.6Not reportedNot reportedNot reported
NpmminimistnpmNot reported0.2.4Not reportedNot reportedNot reported
CpeminimistcpeNot reported1.2.6Not reportedNVD-CVE-2021-44906Not reported
Suserelease-notes-susemanager-proxyrpmmanager proxy 4.24.2.7-150300.3.31.2Not reportedSUSE-SU-2022:2146-1Not reported
Suserelease-notes-susemanager-proxyrpmmanager retail branch server 4.24.2.7-150300.3.31.2Not reportedSUSE-SU-2022:2146-1Not reported
Suserelease-notes-susemanagerrpmmanager server 4.24.2.7-150300.3.44.1Not reportedSUSE-SU-2022:2146-1Not reported
Opensusenodejs8rpmleap 15.38.17.0-150200.10.22.1Not reportedSUSE-SU-2022:1694-1Not reported
Opensusenodejs8rpmleap 15.48.17.0-150200.10.22.1Not reportedSUSE-SU-2022:1694-1Not reported
Susenodejs12rpmlinux enterprise module for web and scripting 1212.22.12-1.48.1Not reportedSUSE-SU-2022:1466-1Not reported
Susenodejs14rpmlinux enterprise module for web and scripting 15 sp314.19.1-150200.15.31.1Not reportedSUSE-SU-2022:1462-1Not reported
Susenodejs14rpmlinux enterprise high performance computing 15 sp2-espos14.19.1-150200.15.31.1Not reportedSUSE-SU-2022:1462-1Not reported
Susenodejs14rpmlinux enterprise high performance computing 15 sp2-ltss14.19.1-150200.15.31.1Not reportedSUSE-SU-2022:1462-1Not reported
Susenodejs14rpmlinux enterprise server 15 sp2-bcl14.19.1-150200.15.31.1Not reportedSUSE-SU-2022:1462-1Not reported
Susenodejs14rpmlinux enterprise server 15 sp2-ltss14.19.1-150200.15.31.1Not reportedSUSE-SU-2022:1462-1Not reported
Susenodejs14rpmlinux enterprise server for sap applications 15 sp214.19.1-150200.15.31.1Not reportedSUSE-SU-2022:1462-1Not reported
Susenodejs14rpmmanager proxy 4.114.19.1-150200.15.31.1Not reportedSUSE-SU-2022:1462-1Not reported
Susenodejs14rpmmanager retail branch server 4.114.19.1-150200.15.31.1Not reportedSUSE-SU-2022:1462-1Not reported
Susenodejs14rpmmanager server 4.114.19.1-150200.15.31.1Not reportedSUSE-SU-2022:1462-1Not reported
Susenodejs14rpmenterprise storage 714.19.1-150200.15.31.1Not reportedSUSE-SU-2022:1462-1Not reported
Opensusenodejs14rpmleap 15.314.19.1-150200.15.31.1Not reportedSUSE-SU-2022:1462-1Not reported
Opensusenodejs14rpmleap 15.414.19.1-150200.15.31.1Not reportedSUSE-SU-2022:1462-1Not reported
Susenodejs14rpmlinux enterprise module for web and scripting 1214.19.1-6.28.1Not reportedSUSE-SU-2022:1459-1Not reported
Susespacecmdrpmmanager proxy module 4.24.2.17-150300.4.21.4Not reportedSUSE-SU-2022:2144-1Not reported
Susespacewalk-backendrpmmanager proxy module 4.24.2.22-150300.4.23.1Not reportedSUSE-SU-2022:2144-1Not reported
Susespacewalk-certs-toolsrpmmanager proxy module 4.24.2.16-150300.3.18.3Not reportedSUSE-SU-2022:2144-1Not reported
Susespacewalk-webrpmmanager proxy module 4.24.2.27-150300.3.21.7Not reportedSUSE-SU-2022:2144-1Not reported
Susesupportutils-plugin-saltrpmmanager proxy module 4.21.2.0-150300.3.3.1Not reportedSUSE-SU-2022:2144-1Not reported
Suseinter-server-syncrpmmanager server module 4.20.2.2-150300.8.17.1Not reportedSUSE-SU-2022:2144-1Not reported
Suseprometheus-formularpmmanager server module 4.20.6.2-150300.3.14.1Not reportedSUSE-SU-2022:2144-1Not reported
Susesalt-netapi-clientrpmmanager server module 4.20.19.0-150300.3.6.1Not reportedSUSE-SU-2022:2144-1Not reported
Susesmdbarpmmanager server module 4.21.7.10-0.150300.3.6.1Not reportedSUSE-SU-2022:2144-1Not reported
Susespacecmdrpmmanager server module 4.24.2.17-150300.4.21.4Not reportedSUSE-SU-2022:2144-1Not reported
Susespacewalk-backendrpmmanager server module 4.24.2.22-150300.4.23.1Not reportedSUSE-SU-2022:2144-1Not reported
Susespacewalk-certs-toolsrpmmanager server module 4.24.2.16-150300.3.18.3Not reportedSUSE-SU-2022:2144-1Not reported
Susespacewalk-javarpmmanager server module 4.24.2.38-150300.3.35.1Not reportedSUSE-SU-2022:2144-1Not reported
Susespacewalk-utilsrpmmanager server module 4.24.2.16-150300.3.15.5Not reportedSUSE-SU-2022:2144-1Not reported
Susespacewalk-webrpmmanager server module 4.24.2.27-150300.3.21.7Not reportedSUSE-SU-2022:2144-1Not reported
Susesupportutils-plugin-saltrpmmanager server module 4.21.2.0-150300.3.3.1Not reportedSUSE-SU-2022:2144-1Not reported
Susesusemanagerrpmmanager server module 4.24.2.32-150300.3.31.1Not reportedSUSE-SU-2022:2144-1Not reported
Susesusemanager-doc-indexesrpmmanager server module 4.24.2-150300.12.27.6Not reportedSUSE-SU-2022:2144-1Not reported
Susesusemanager-docs_enrpmmanager server module 4.24.2-150300.12.27.1Not reportedSUSE-SU-2022:2144-1Not reported
Susesusemanager-schemarpmmanager server module 4.24.2.22-150300.3.21.6Not reportedSUSE-SU-2022:2144-1Not reported
Susesusemanager-slsrpmmanager server module 4.24.2.23-150300.3.25.4Not reportedSUSE-SU-2022:2144-1Not reported
Susesusemanager-sync-datarpmmanager server module 4.24.2.12-150300.3.18.3Not reportedSUSE-SU-2022:2144-1Not reported
Susevirtual-host-gathererrpmmanager server module 4.21.0.23-150300.3.3.1Not reportedSUSE-SU-2022:2144-1Not reported
Susenodejs12rpmlinux enterprise module for web and scripting 15 sp312.22.12-150200.4.32.1Not reportedSUSE-SU-2022:1461-1Not reported
Susenodejs12rpmlinux enterprise high performance computing 15 sp2-espos12.22.12-150200.4.32.1Not reportedSUSE-SU-2022:1461-1Not reported
Susenodejs12rpmlinux enterprise high performance computing 15 sp2-ltss12.22.12-150200.4.32.1Not reportedSUSE-SU-2022:1461-1Not reported
Susenodejs12rpmlinux enterprise server 15 sp2-bcl12.22.12-150200.4.32.1Not reportedSUSE-SU-2022:1461-1Not reported
Susenodejs12rpmlinux enterprise server 15 sp2-ltss12.22.12-150200.4.32.1Not reportedSUSE-SU-2022:1461-1Not reported
Susenodejs12rpmlinux enterprise server for sap applications 15 sp212.22.12-150200.4.32.1Not reportedSUSE-SU-2022:1461-1Not reported
Susenodejs12rpmmanager proxy 4.112.22.12-150200.4.32.1Not reportedSUSE-SU-2022:1461-1Not reported
Susenodejs12rpmmanager retail branch server 4.112.22.12-150200.4.32.1Not reportedSUSE-SU-2022:1461-1Not reported
Susenodejs12rpmmanager server 4.112.22.12-150200.4.32.1Not reportedSUSE-SU-2022:1461-1Not reported
Susenodejs12rpmenterprise storage 712.22.12-150200.4.32.1Not reportedSUSE-SU-2022:1461-1Not reported
Opensusenodejs12rpmleap 15.312.22.12-150200.4.32.1Not reportedSUSE-SU-2022:1461-1Not reported
Opensusenodejs12rpmleap 15.412.22.12-150200.4.32.1Not reportedSUSE-SU-2022:1461-1Not reported

OpenFactory catalog packages

[Debian 12 (Bookworm)]

  • [node-minimist]Fixed
    Details (2)

    • 1.2.7+~cs5.3.2-2 · all · bookworm

      Fixed · Fixed: 1.2.6+~cs5.3.2-1

      dsa · node-minimist · debian · bookworm; dsa · node-minimist · debian · 12

    • 1.2.7+~cs5.3.2-2 · all · bookworm

      Fixed · Fixed: 1.2.6+~cs5.3.2-1

      dsa · node-minimist · debian · bookworm; dsa · node-minimist · debian · 12

[Debian 13 (Trixie)]

  • [node-minimist]Fixed
    Details (2)

    • 1.2.8+~cs5.3.5-1 · all · trixie

      Fixed · Fixed: 1.2.6+~cs5.3.2-1

      dsa · node-minimist · debian · 13

    • 1.2.8+~cs5.3.5-1 · all · trixie

      Fixed · Fixed: 1.2.6+~cs5.3.2-1

      dsa · node-minimist · debian · 13

Observed:

References

[CERT-Bund public advisories] · [Debian Security Tracker] · [FIRST EPSS] · [National Vulnerability Database (NVD)] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX]