CVE-2022-21824 Other in Node

High 8.2 Published 24 Feb 2022 Updated 30 Apr 2025

Prototype pollution in Node.js console.table allows limited assignment of empty strings to object prototype keys via user-controlled input.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2022-21824?

CVE-2022-21824 is a high-severity vulnerability in Debian Debian Linux, published on 24 Feb 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Due to the formatting logic of the "console.table()" function it was not safe to allow user controlled input to be passed to the "properties" parameter while simultaneously passing a plain object with at least one property as the first parameter, which could be "__proto__". The prototype pollution has very limited control, in that it only allows an empty string to be assigned to numerical keys of the object prototype.Node.js >= 12.22.9, >= 14.18.3, >= 16.13.2, and >= 17.3.1 use a null protoype for the object these properties are being assigned to.

Weakness: CWE-1321, CWE-471

Which versions are affected by CVE-2022-21824?

2 open source packages ship an affected version, including node and node-min. It affects 11 products.

Package	Affected	Fixed in
`node` Bitnami	From `12.0.0`	`12.22.9, 14.18.3, 16.13.2, 17.3.1`
`node-min` Bitnami	From `12.0.0`	`12.22.9, 14.18.3, 16.13.2, 17.3.1`

Products include Debian Debian Linux, Netapp Oncommand Insight, Netapp Oncommand Workflow Automation, Netapp Snapcenter, Nodejs Node.js, Oracle Mysql Cluster and 5 more.

How do I fix CVE-2022-21824?

Upgrade node to a fixed version for your release line: 12.22.9, 14.18.3, 16.13.2 or 17.3.1.

Is CVE-2022-21824 being exploited?

There is no known exploitation of CVE-2022-21824 in the wild and no public exploit code.

All Debian Debian Linux vulnerabilities

Sources

Also known as ALPINE-CVE-2022-21824, AZL-8864, BIT-node-2022-21824, BIT-node-min-2022-21824, CLEANSTART-2026-IE74583, CLEANSTART-2026-JZ00429 and 3 more.