Non notée
CVE-2022-21824 Due to the formatting logic of the "console.table()" function it was not safe to allow user controlled input to be…
Description
Due to the formatting logic of the "console.table()" function it was not safe to allow user controlled input to be passed to the "properties" parameter while simultaneously passing a plain object with at least one property as the first parameter, which could be "__proto__". The prototype pollution has very limited control, in that it only allows an empty string to be assigned to numerical keys of the object prototype.Node.js >= 12.22.9, >= 14.18.3, >= 16.13.2, and >= 17.3.1 use a null protoype for the object these properties are being assigned to.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| Node 17.0 | 17.0 → < 17.3.1 | 17.3.1 |
| Node 16.0 | 16.0 → < 16.13.2 | 16.13.2 |
| Node 15.0 | 15.0 → dernières | Pas de correctif indiqué |
| Node 14.0 | 14.0 → < 14.18.3 | 14.18.3 |
| Node 13.0 | 13.0 → dernières | Pas de correctif indiqué |
| Node 12.0 | 12.0 → < 12.22.9 | 12.22.9 |
| Node 11.0 | 11.0 → dernières | Pas de correctif indiqué |
| Node 10.0 | 10.0 → dernières | Pas de correctif indiqué |
| Node 9.0 | 9.0 → dernières | Pas de correctif indiqué |
Afficher les 5 autres branches Masquer les 5 autres branches
Références
- nodejs.org nodejs.org
- hackerone.com hackerone.com
- www.oracle.com www.oracle.com
- security.netapp.com security.netapp.com
- DSA-5170 www.debian.org
- www.oracle.com www.oracle.com
- security.netapp.com security.netapp.com
- [debian-lts-announce] 20221005 [SECURITY] [DLA 3137-1] nodejs security update lists.debian.org
Chronologie
- Publiée
- Dernière modification
Autres CVE de Node
Les 129 CVE de Node →
CVE-2026-106069
A flaw in Node.js TLS hostname verification can cause a server certificate to be validated against a different IP…
7.4
Élevée
CVE-2026-105482
A flaw in Node.js DNS resolution allows hostnames containing a NUL byte to be silently truncated by the dns.resolve*()…
7.4
Élevée
CVE-2026-105483
A flaw in Node.js TLS hostname verification allows a certificate without a matching IP address SAN to authenticate a…
7.4
Élevée
CVE-2026-105481
A flaw in Node.js HTTP Agent connection reuse can cause a client to accept as valid a response that was sent before…
6.5
Moyenne