Fluid Attacks Database

Description

Prototype Pollution in minimist Minimist prior to 1.2.6 and 0.2.4 is vulnerable to Prototype Pollution via file index.js, function setKey() (lines 69-95).

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem	Component	Affected version	Patched versions
debian 11	node-minimist	=1.2.5+~cs5.3.1-2 \|\| >=0 <1.2.5+~cs5.3.1-2+deb11u1	1.2.5+~cs5.3.1-2+deb11u1
debian 12	node-minimist	>=0 <1.2.6+~cs5.3.2-1	1.2.6+~cs5.3.2-1
npm	minimist	>=1.0.0 <1.2.6 \|\| >=0 <0.2.4	1.2.6, 0.2.4
debian 14	node-minimist	>=0 <1.2.6+~cs5.3.2-1	1.2.6+~cs5.3.2-1
debian 13	node-minimist	>=0 <1.2.6+~cs5.3.2-1	1.2.6+~cs5.3.2-1
rpm rhel8.6	nodejs	<1:14.21.3-1.module+el8.6.0+18532+cbe6f646	1:14.21.3-1.module+el8.6.0+18532+cbe6f646
rpm rhel9	nodejs-nodemon	<0:2.0.20-2.el9_1	0:2.0.20-2.el9_1
rpm rhel8	nodejs-nodemon	-	-
rpm rhel9	nodejs	<1:16.18.1-3.el9_1	1:16.18.1-3.el9_1
rpm rhel8	nodejs	-	-

1-10 of 11

Aliases

1. CVE-2021-449062. NVD-2021-449063. OSV-DEBIAN-2021-449064. OSV-2021-449065. GCVE-2021-449066. SECURITY-TRACKER-CVE-2021-44906

References

Does your application use this vulnerable software?

During the free trial, our tools assess your application, identify vulnerabilities, and provide recommendations for their remediation.