Skip to content
Fencer Vulns
critical 9.8

CVE-2021-44906 json

Prototype Pollution in minimist

published 2022-03-17 4 y ago modified 2026-10-08 31 d ago also GHSA-xvch-5gv4-984h , EUVD-2022-1589

cvss
9.8
version 3.1, NVD
cisa kev
Not listed
not in CISA's catalog
epss
4.6%
EPSS 4.6% chance of exploitation in 30 days, percentile 91%
public exploits
0
none known

Summary

Minimist <=1.2.5 is vulnerable to Prototype Pollution via file index.js, function setKey() (lines 69-95).

Patch / fix

  • npm minimist 0.2.4, 1.2.6
  • substack minimist 1.2.6
  • node-minimist Debian 14, Debian 13, Debian 12 1.2.6+~cs5.3.2-1

debian advisories DEBIAN-CVE-2021-44906

  • nodejs-packaging RHEL 8, RHEL 8.6 EUS, RHEL 8.4 EUS 23-3.module+el8.3.0+6519+9f98ed83
  • npm RHEL 8 1:6.14.17-1.14.21.1.2.module+el8.7.0+17528+a329cd47
  • nodejs RHEL 8 1:14.21.1-2.module+el8.7.0+17528+a329cd47
  • nodejs-nodemon RHEL 8 2.0.20-2.module+el8.7.0+17528+a329cd47
  • nodejs-full-i18n RHEL 8 1:14.21.1-2.module+el8.7.0+17528+a329cd47
  • npm RHEL 8 1:8.19.2-1.16.18.1.3.module+el8.7.0+17465+1a1abd74
  • nodejs RHEL 8 1:16.18.1-3.module+el8.7.0+17465+1a1abd74
  • nodejs-nodemon RHEL 8 2.0.20-2.module+el8.7.0+17412+bb0e4a6b

red hat advisories RHSA-2025:1747RHSA-2023:1742RHSA-2023:1533RHSA-2023:0050RHSA-2022:9073RHSA-2023:1043

  • release-notes-susemanager-proxy Manager Retail Branch Server 4.2, Manager Proxy 4.2 4.2.7-150300.3.31.2
  • release-notes-susemanager Manager Server 4.2 4.2.7-150300.3.44.1
  • smdba Manager Server Module 4.2 1.7.10-0.150300.3.6.1
  • spacecmd Manager Server Module 4.2, Manager Proxy Module 4.2 4.2.17-150300.4.21.4
  • susemanager Manager Server Module 4.2 4.2.32-150300.3.31.1
  • spacewalk-web Manager Server Module 4.2, Manager Proxy Module 4.2 4.2.27-150300.3.21.7
  • spacewalk-java Manager Server Module 4.2 4.2.38-150300.3.35.1
  • spacewalk-utils Manager Server Module 4.2 4.2.16-150300.3.15.5

suse advisories SUSE-SU-2022:2146-1SUSE-SU-2022:2144-1SUSE-SU-2022:1717-1SUSE-SU-2022:1694-1SUSE-SU-2022:1466-1SUSE-SU-2022:1462-1

  • nodejs AlmaLinux 9 1:16.18.1-3.el9_1
  • nodejs-nodemon AlmaLinux 9 2.0.20-2.el9_1
  • npm AlmaLinux 9 1:8.19.2-1.16.18.1.3.el9_1
  • nodejs-libs AlmaLinux 9 1:16.18.1-3.el9_1
  • nodejs-full-i18n AlmaLinux 9 1:16.18.1-3.el9_1
  • npm AlmaLinux 8 1:6.14.17-1.14.21.1.2.module_el8.7.0+3373+a4c18c43
  • nodejs AlmaLinux 8 1:14.21.1-2.module_el8.7.0+3373+a4c18c43
  • nodejs-nodemon AlmaLinux 8 2.0.20-2.module_el8.7.0+3373+a4c18c43

almalinux advisories ALSA-2023:0321ALSA-2023:0050ALSA-2022:9073

  • nodejs Rocky Linux 9 1:16.18.1-3.el9_1
  • nodejs-nodemon Rocky Linux 9 2.0.20-2.el9_1
  • nodejs Rocky Linux 8 1:14.21.1-2.module+el8.7.0+1116+bd2a84b4
  • nodejs-nodemon Rocky Linux 8 2.0.20-2.module+el8.7.0+1108+49363b0d
  • nodejs-packaging Rocky Linux 8 23-3.module+el8.7.0+1071+4bdda2a8
  • nodejs-packaging Rocky Linux 8 23-3.module+el8.3.0+100+234774f7
  • nodejs-packaging Rocky Linux 8 23-3.module+el8.5.0+733+de4fee6c
  • nodejs Rocky Linux 8 1:16.18.1-3.module+el8.7.0+1108+49363b0d

rocky linux advisories RLSA-2023:0321RLSA-2023:0050RLSA-2022:9073

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2021-44906 updated cvss 3.1

minimist: prototype pollution

  • Red Hat Migration Toolkit for Containers rhmtc/openshift-migration-ui-rhel8 Red Hat 3scale API Management Platform 2 3scale-amp2/apicast-rhel7-operator, 3scale-amp2/3scale-apicast-operator-bundle
    affected: no fix available
  • Red Hat Enterprise Linux 8 npm, nodejs, nodejs-libs, nodejs-nodemon, nodejs-full-i18n, nodejs-packaging, +1 more
    affected: no fix planned “Out of support scope”
  • Red Hat Fuse 7 io.apicurio-apicurito, io.hawt-hawtio-online, io.syndesis-syndesis-ui
    affected: no fix planned “Will not fix”
  • Red Hat OpenShift Container Platform 3.11 openshift3/grafana, openshift3/ose-console
    affected: no fix planned “Out of support scope”
  • Red Hat OpenShift Container Platform 4 openshift4/ose-metering-hadoop
    affected: no fix planned “Will not fix”
  • Red Hat OpenShift GitOps openshift-gitops-1/argocd-rhel8
    affected: no fix available
  • Red Hat Quay 3 nodejs-minimist Red Hat Satellite 6 tfm-rubygem-rabl
    affected: no fix planned “Will not fix”
  • Red Hat Middleware Containers for OpenShift rh-sso-7/sso76-openshift-rhel8 7.6-20
    fixed: vendor fix RHSA-2023:1047
show 19 more
  • Red Hat OpenShift Service Mesh 2.1 openshift-service-mesh/kiali-rhel8 1.36.9-1
    fixed: vendor fix RHSA-2022:1739
  • Red Hat Enterprise Linux AppStream (v. 8) nodejs 14.21.1-2.module+el8.7.0+17528+a329cd47, nodejs 16.18.1-3.module+el8.7.0+17465+1a1abd74, nodejs-packaging 23-3.module+el8.3.0+6519+9f98ed83, nodejs-packaging 25-1.module+el8.5.0+10992+fac5fe06, npm 8.19.2-1.16.18.1.3.module+el8.7.0+17465+1a1abd74, nodejs-nodemon 2.0.20-2.module+el8.7.0+17412+bb0e4a6b, +4 more
    fixed: vendor fix RHSA-2023:0050
  • Red Hat Enterprise Linux AppStream (v. 9) nodejs 16.18.1-3.el9_1, nodejs-libs 16.18.1-3.el9_1, npm 8.19.2-1.16.18.1.3.el9_1, nodejs-nodemon 2.0.20-2.el9_1, nodejs-full-i18n 16.18.1-3.el9_1
    fixed: vendor fix RHSA-2023:0321
  • Red Hat Enterprise Linux AppStream EUS (v.8.4) nodejs 14.21.3-1.module+el8.4.0+18317+43f5ac16, nodejs-packaging 23-3.module+el8.3.0+6519+9f98ed83, nodejs-nodemon 2.0.20-3.module+el8.4.0+18317+43f5ac16, npm 6.14.18-1.14.21.3.1.module+el8.4.0+18317+43f5ac16, nodejs-full-i18n 14.21.3-1.module+el8.4.0+18317+43f5ac16
    fixed: vendor fix RHSA-2023:1533
  • Red Hat Enterprise Linux AppStream EUS (v.8.6) nodejs 14.21.3-1.module+el8.6.0+18532+cbe6f646, nodejs-packaging 23-3.module+el8.3.0+6519+9f98ed83, nodejs-nodemon 2.0.20-3.module+el8.6.0+18532+cbe6f646, npm 6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646, nodejs-full-i18n 14.21.3-1.module+el8.6.0+18532+cbe6f646
    fixed: vendor fix RHSA-2023:1742
  • Red Hat Fuse 7.11.1
    fixed: vendor fix RHSA-2022:8652
  • Red Hat JBoss EAP 7.4 for RHEL 7 Server eap7-hal-console 3.3.13-1.Final_redhat_00001.1.el7eap
    fixed: vendor fix RHSA-2022:5892
  • Red Hat JBoss EAP 7.4 for RHEL 8 eap7-hal-console 3.3.13-1.Final_redhat_00001.1.el8eap
    fixed: vendor fix RHSA-2022:5893
  • Red Hat JBoss EAP 7.4 for RHEL 9 eap7 1-18.el9eap, eap7-runtime 1-18.el9eap, eap7-vdx 1.1.6-2.redhat_1.1.el9eap, eap7-antlr 2.7.7-54.redhat_7.1.el9eap, eap7-avro 1.7.6-7.1.redhat_2.1.el9eap, eap7-cal10n 0.8.1-6.redhat_1.1.el9eap, +414 more
    fixed: vendor fix RHSA-2022:5894
  • Red Hat JBoss Enterprise Application Platform hal-console 3.3.13.Final-redhat-00001
    fixed: vendor fix RHSA-2022:5928
  • Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7 Server eap7-jettison 1.5.2-2.redhat_00002.1.el7eap, eap7-wildfly 7.3.12-3.GA_redhat_00002.1.el7eap, eap7-netty 4.1.63-4.Final_redhat_00002.1.el7eap, eap7-jackson-core 2.10.4-2.redhat_00004.1.el7eap, eap7-snakeyaml 1.33.0-1.SP1_redhat_00001.1.el7eap, eap7-resteasy 3.11.6-1.Final_redhat_00001.1.el7eap, +35 more
    fixed: vendor fix RHSA-2025:1747
  • Red Hat OpenShift Container Platform 4.11 openshift4/ose-grafana v4.11.0-202208020235.p0.g6773185.assembly.stream, openshift4/ose-prometheus v4.11.0-202208020235.p0.gd2dfc27.assembly.stream, openshift4/ose-thanos-rhel8 v4.11.0-202208020235.p0.gf08da2d.assembly.stream
    fixed: vendor fix RHSA-2022:5069
  • Red Hat Single Sign-On 7
    fixed: vendor fix RHSA-2023:1049
  • Red Hat Single Sign-On 7.6 for RHEL 7 Server rh-sso7-keycloak 18.0.6-1.redhat_00001.1.el7sso, rh-sso7-keycloak-server 18.0.6-1.redhat_00001.1.el7sso
    fixed: vendor fix RHSA-2023:1043
  • Red Hat Single Sign-On 7.6 for RHEL 8 rh-sso7-keycloak 18.0.6-1.redhat_00001.1.el8sso, rh-sso7-keycloak-server 18.0.6-1.redhat_00001.1.el8sso
    fixed: vendor fix RHSA-2023:1044
  • Red Hat Single Sign-On 7.6 for RHEL 9 rh-sso7-keycloak 18.0.6-1.redhat_00001.1.el9sso, rh-sso7-keycloak-server 18.0.6-1.redhat_00001.1.el9sso
    fixed: vendor fix RHSA-2023:1045
  • Red Hat Software Collections for RHEL Workstation(v. 7) rh-nodejs14-nodejs 14.20.1-2.el7, rh-nodejs14-nodejs 14.21.1-3.el7, rh-nodejs12-nodejs 12.22.12-2.el7, rh-nodejs14-npm 6.14.17-14.20.1.2.el7, rh-nodejs14-npm 6.14.17-14.21.1.3.el7, rh-nodejs12-npm 6.14.16-12.22.12.2.el7, +2 more Red Hat Software Collections for RHEL(v. 7) rh-nodejs14-nodejs 14.20.1-2.el7, rh-nodejs14-nodejs 14.21.1-3.el7, rh-nodejs12-nodejs 12.22.12-2.el7, rh-nodejs14-npm 6.14.17-14.20.1.2.el7, rh-nodejs14-npm 6.14.17-14.21.1.3.el7, rh-nodejs12-npm 6.14.16-12.22.12.2.el7, +2 more
    fixed: vendor fix RHSA-2022:4914
  • Red Hat RHPAM 7.13.1 async
    fixed: vendor fix RHSA-2022:6813
  • Red Hat Logging Subsystem for Red Hat OpenShift openshift-logging/kibana6-rhel8 Red Hat OpenShift Service Mesh 2.1 openshift-service-mesh/kiali-rhel8-operator 1.36.9-2, openshift-service-mesh/istio-must-gather-rhel8 2.1.2-3 Red Hat JBoss EAP 7.4 for RHEL 7 Server eap7-gson 2.8.9-1.redhat_00001.1.el7eap, eap7-jberet 1.3.9-2.SP2_redhat_00001.1.el7eap, eap7-wildfly 7.4.6-5.GA_redhat_00002.1.el7eap, eap7-apache-cxf 3.3.13-1.redhat_00001.1.el7eap, eap7-jandex 2.4.2-1.Final_redhat_00001.1.el7eap, eap7-netty 4.1.77-1.Final_redhat_00001.1.el7eap, +81 more Red Hat JBoss EAP 7.4 for RHEL 8 eap7-gson 2.8.9-1.redhat_00001.1.el8eap, eap7-jberet 1.3.9-2.SP2_redhat_00001.1.el8eap, eap7-wildfly 7.4.6-5.GA_redhat_00002.1.el8eap, eap7-apache-cxf 3.3.13-1.redhat_00001.1.el8eap, eap7-jandex 2.4.2-1.Final_redhat_00001.1.el8eap, eap7-netty 4.1.77-1.Final_redhat_00001.1.el8eap, +79 more Red Hat JBoss Enterprise Application Platform pom.xml, c3 0.6.0, c3 0.7.1, d3 5.9.2, ms 2.0.0, ms 2.1.2, +1483 more Red Hat JBoss Enterprise Application Platform Expansion Pack org.jboss.hal-hal-parent
    +4 more products
    Red Hat OpenShift Container Platform 4 openshift4/ose-console Red Hat OpenShift Container Platform 4.11 openshift4/ose-cli v4.11.0-202208020706.p0.g7075089.assembly.stream, openshift4/ose-pod v4.11.0-202208020235.p0.g9546431.assembly.stream, openshift4/ose-etcd v4.11.0-202208020235.p0.g80cc14e.assembly.stream, openshift4/ose-tests v4.11.0-202208020706.p0.gb860532.assembly.stream, openshift4/ose-console v4.11.0-202208021257.p0.ge0d49a2.assembly.stream, openshift4/ose-coredns v4.11.0-202208020235.p0.g7fe212f.assembly.stream, +173 more Red Hat Openshift Data Foundation 4 odf4/mcg-core-rhel8, odf4/odf-console-rhel9 Red Hat Virtualization 4 ovirt-engine-ui-extensions
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
yes
Technical impact
total
Assessed
31 d ago

Exploit prediction

4.58% chance of exploitation in the next 30 days, higher than 91% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

  • snyk.io https://snyk.io/vuln/SNYK-JS-MINIMIST-559764 referenced PoC, tagged "exploit" by a source, unverified
  • github.com https://github.com/substack/minimist/issues/164 referenced PoC, tagged "exploit" by a source, unverified
  • github.com https://github.com/Marynk/JavaScript-vulnerability-detection/blob/main/minimist%20PoC.zip referenced PoC, tagged "exploit" by a source, unverified
  • github.com https://github.com/substack/minimist/blob/master/index.js#L69 referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by version score vector
NVD 3.1 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
NVD 2.0 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P
GitHub 3.1 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected packages

ecosystem package affected fixed in
npm minimist
>=1.0.0, <1.2.6
<0.2.4
1.2.6
0.2.4

Classification

Weakness
  • CWE-1321 Improperly Controlled Modification of Object Prototype Attributes

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.