Catalogo CVE

CVE-2022-21824

nodejs affected and fixed versions

Due to the formatting logic of the "console.table()" function it was not safe to allow user controlled input to be passed to the "properties" parameter while simultaneously passing a plain object with at least one property as the first parameter, which could be "__proto__". The prototype pollution has very limited control, in that it only allows an empty string to be assigned to numerical keys of the object prototype.Node.js >= 12.22.9, >= 14.18.3, >= 16.13.2, and >= 17.3.1 use a null protoype for the object these properties are being assigned to.

Gravità: High · CVSS 8.2CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H
Published: Jan 10, 2022, 12:00:00 AM UTC
Source: [NVD] · [CVE record]
EPSS: 21.51% · Oct 27, 2026

Projects and upstream resources

[nodejs][Source-reported homepage]

Reported versions and fixes

Each observation applies to its named package, distribution, and release. Distribution backports can fix a vulnerability while retaining an older upstream version number.

Distribution / release	Package	Version	Status	Source
Debiantrixie-security	nodejs	`20.19.2+dfsg-1+deb13u3`	Fixed	[CVE-2022-21824]
Debiantrixie	nodejs	`12.22.9~dfsg-1`	FixedDistribution-reported fixed boundary	[CVE-2022-21824]
Debiantrixie	nodejs	`20.19.2+dfsg-1+deb13u2`	Fixed	[CVE-2022-21824]
Debiansid	nodejs	`12.22.9~dfsg-1`	FixedDistribution-reported fixed boundary	[CVE-2022-21824]
Debiansid	nodejs	`24.22.2+dfsg+~cs24.19.2-1`	Fixed	[CVE-2022-21824]
Debianforky	nodejs	`12.22.9~dfsg-1`	FixedDistribution-reported fixed boundary	[CVE-2022-21824]
Debianforky	nodejs	`24.21.0+dfsg+~cs24.13.4-1`	Fixed	[CVE-2022-21824]
Debianbookworm-security	nodejs	`18.20.4+dfsg-1~deb12u3`	Fixed	[CVE-2022-21824]
Debianbookworm	nodejs	`12.22.9~dfsg-1`	FixedDistribution-reported fixed boundary	[CVE-2022-21824]
Debianbookworm	nodejs	`18.20.4+dfsg-1~deb12u2`	Fixed	[CVE-2022-21824]

Showing 10 fix observations. All 11 observations, including unknown and conflicting reports, are available below.

Provider details and historical evidence

Distribution / release	Package	Version	Status	Source
UnknownRelease not reported	nodejs	`12.22.9~dfsg-1`	UnknownSource applicability is not established	Provider not reported
Debianbookworm	nodejs	`12.22.9~dfsg-1`	FixedDistribution-reported fixed boundary	[CVE-2022-21824]
Debianbookworm	nodejs	`18.20.4+dfsg-1~deb12u2`	Fixed	[CVE-2022-21824]
Debianbookworm-security	nodejs	`18.20.4+dfsg-1~deb12u3`	Fixed	[CVE-2022-21824]
Debianforky	nodejs	`12.22.9~dfsg-1`	FixedDistribution-reported fixed boundary	[CVE-2022-21824]
Debianforky	nodejs	`24.21.0+dfsg+~cs24.13.4-1`	Fixed	[CVE-2022-21824]
Debiansid	nodejs	`12.22.9~dfsg-1`	FixedDistribution-reported fixed boundary	[CVE-2022-21824]
Debiansid	nodejs	`24.22.2+dfsg+~cs24.19.2-1`	Fixed	[CVE-2022-21824]
Debiantrixie	nodejs	`12.22.9~dfsg-1`	FixedDistribution-reported fixed boundary	[CVE-2022-21824]
Debiantrixie	nodejs	`20.19.2+dfsg-1+deb13u2`	Fixed	[CVE-2022-21824]
Debiantrixie-security	nodejs	`20.19.2+dfsg-1+deb13u3`	Fixed	[CVE-2022-21824]

Original provider fields

{
  "package_releases": [
    {
      "name": "nodejs",
      "status": "fixed",
      "release": "sid",
      "version": "24.22.2+dfsg+~cs24.19.2-1"
    },
    {
      "name": "nodejs",
      "status": "fixed",
      "release": "forky",
      "version": "24.21.0+dfsg+~cs24.13.4-1"
    },
    {
      "name": "nodejs",
      "status": "fixed",
      "release": "trixie",
      "version": "20.19.2+dfsg-1+deb13u2"
    },
    {
      "name": "nodejs",
      "status": "fixed",
      "release": "trixie-security",
      "version": "20.19.2+dfsg-1+deb13u3"
    },
    {
      "name": "nodejs",
      "status": "fixed",
      "release": "bookworm",
      "version": "18.20.4+dfsg-1~deb12u2"
    },
    {
      "name": "nodejs",
      "status": "fixed",
      "release": "bookworm-security",
      "version": "18.20.4+dfsg-1~deb12u3"
    }
  ],
  "fixed_versions": [
    {
      "bug": 1004177,
      "name": "nodejs",
      "type": "source",
      "origin": null,
      "release": "sid",
      "urgency": "not yet assigned",
      "fixed_version": "12.22.9~dfsg-1"
    },
    {
      "bug": 1004177,
      "name": "nodejs",
      "type": "source",
      "origin": null,
      "release": "forky",
      "urgency": "not yet assigned",
      "fixed_version": "12.22.9~dfsg-1"
    },
    {
      "bug": 1004177,
      "name": "nodejs",
      "type": "source",
      "origin": null,
      "release": "trixie",
      "urgency": "not yet assigned",
      "fixed_version": "12.22.9~dfsg-1"
    },
    {
      "bug": 1004177,
      "name": "nodejs",
      "type": "source",
      "origin": null,
      "release": "bookworm",
      "urgency": "not yet assigned",
      "fixed_version": "12.22.9~dfsg-1"
    }
  ],
  "distribution_packages": [
    {
      "name": "nodejs",
      "fixed_version": "12.22.9~dfsg-1",
      "applicability_unknown": true
    }
  ]
}

[Debian bug #1004177]

OpenFactory catalog packages

L’associazione dei pacchetti è in corso.

[Debian 12 (Bookworm)]

[libnode108]Sconosciuto
Pacchetto sorgente: [nodejs]
Dettagli (4)
- 18.20.4+dfsg-1~deb12u2 · amd64 · bookworm
  Corretta · Corretta: 12.22.9~dfsg-1
  dsa · nodejs · debian · bookworm
- 18.20.4+dfsg-1~deb12u2 · arm64 · bookworm
  Corretta · Corretta: 12.22.9~dfsg-1
  dsa · nodejs · debian · bookworm
- 18.20.4+dfsg-1~deb12u2 · amd64 · bookworm-security
  Corretta · Corretta: 12.22.9~dfsg-1
  dsa · nodejs · debian · bookworm
- 18.20.4+dfsg-1~deb12u2 · arm64 · bookworm-security
  Corretta · Corretta: 12.22.9~dfsg-1
  dsa · nodejs · debian · bookworm
[libnode-dev]Sconosciuto
Pacchetto sorgente: [nodejs]
Dettagli (4)
- 18.20.4+dfsg-1~deb12u2 · amd64 · bookworm
  Corretta · Corretta: 12.22.9~dfsg-1
  dsa · nodejs · debian · bookworm
- 18.20.4+dfsg-1~deb12u2 · arm64 · bookworm
  Corretta · Corretta: 12.22.9~dfsg-1
  dsa · nodejs · debian · bookworm
- 18.20.4+dfsg-1~deb12u2 · amd64 · bookworm-security
  Corretta · Corretta: 12.22.9~dfsg-1
  dsa · nodejs · debian · bookworm
- 18.20.4+dfsg-1~deb12u2 · arm64 · bookworm-security
  Corretta · Corretta: 12.22.9~dfsg-1
  dsa · nodejs · debian · bookworm
[nodejs]Sconosciuto
Dettagli (4)
- 18.20.4+dfsg-1~deb12u2 · amd64 · bookworm
  Corretta · Corretta: 12.22.9~dfsg-1
  dsa · nodejs · debian · bookworm
- 18.20.4+dfsg-1~deb12u2 · arm64 · bookworm
  Corretta · Corretta: 12.22.9~dfsg-1
  dsa · nodejs · debian · bookworm
- 18.20.4+dfsg-1~deb12u2 · amd64 · bookworm-security
  Corretta · Corretta: 12.22.9~dfsg-1
  dsa · nodejs · debian · bookworm
- 18.20.4+dfsg-1~deb12u2 · arm64 · bookworm-security
  Corretta · Corretta: 12.22.9~dfsg-1
  dsa · nodejs · debian · bookworm
[nodejs-doc]Sconosciuto
Pacchetto sorgente: [nodejs]
Dettagli (4)
- 18.20.4+dfsg-1~deb12u2 · all · bookworm
  Corretta · Corretta: 12.22.9~dfsg-1
  dsa · nodejs · debian · bookworm
- 18.20.4+dfsg-1~deb12u2 · all · bookworm
  Corretta · Corretta: 12.22.9~dfsg-1
  dsa · nodejs · debian · bookworm
- 18.20.4+dfsg-1~deb12u2 · all · bookworm-security
  Corretta · Corretta: 12.22.9~dfsg-1
  dsa · nodejs · debian · bookworm
- 18.20.4+dfsg-1~deb12u2 · all · bookworm-security
  Corretta · Corretta: 12.22.9~dfsg-1
  dsa · nodejs · debian · bookworm

Osservato: Oct 28, 2026, 6:16:56 PM UTC

Riferimenti

[CERT-Bund public advisories] · [Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX]