CVE-2022-21824: Prototype pollution via console.table properties

Published Jan 10, 2022
·
Updated

Due to the formatting logic of the "console.table()" function it was not safe to allow user controlled input to be passed to the "properties" parameter while simultaneously passing a plain object with at least one property as the first parameter, which could be "proto". The prototype pollution has very limited control, in that it only allows an empty string to be assigned to numerical keys of the object prototype.Node.js >= 12.22.9, >= 14.18.3, >= 16.13.2, and >= 17.3.1 use a null protoype for the object these properties are being assigned to.

Other sources

Due to the formatting logic of the console.table() function it was not safe to allow user controlled input to be passed to the properties parameter while simultaneously passing a plain object with at least one property as the first parameter, which could be proto. The prototype pollution has very limited control, in that it only allows an empty string to be assigned to numerical keys of the object prototype.

Versions of Node.js with the fix for this use a null prototype for the object these properties are being assigned to.

More details will be available at CVE-2022-21824 after publication.

Thanks to Patrik Oldsberg (rugvip) for reporting this vulnerability.

All versions of the 17.x, 16.x, 14.x, and 12.x releases lines.

— Node.Js

Due to the formatting logic of the console.table() function it was not safe to allow user controlled input to be passed to the properties parameter while simultaneously passing a plain object with at least one property as the first parameter, which could be proto. The prototype pollution has very limited control, in that it only allows an empty string to be assigned to numerical keys of the object prototype.

Versions of Node.js with the fix for this use a null protoype for the object these properties are being assigned to.

Reference: https://nodejs.org/en/blog/vulnerability/jan-2022-security-releases/

— Red Hat

Due to the formatting logic of the console.table() function it was not safe to allow user controlled input to be passed to the properties parameter while simultaneously passing a plain object with at least one property as the first parameter, which could be proto. The prototype pollution has very limited control, in that it only allows an empty string to be assigned to numerical keys of the object prototype. See https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-21824 for more details.

— Node.Js

Node.js could provide weaker than expected security, caused by an error related to the formatting logic of the console.table() function. An attacker could exploit this vulnerability using console.table properties to allow an empty string to be assigned to numerical keys of the object prototype.

— IBM

Affected Software

66 affected componentsFixes available
redhat/rh-nodejs12-nodejs<0:12.22.12-2.el7
0:12.22.12-2.el7
redhat/rh-nodejs14-nodejs<0:14.20.1-2.el7
0:14.20.1-2.el7
Nodejs Node.js>=12.0.0<12.22.9
Nodejs Node.js>=14.0.0<14.18.3
Nodejs Node.js>=16.0.0<16.13.2
Nodejs Node.js>=17.0.0<17.3.1
Oracle MySQL Cluster<=8.0.29
Oracle MySQL Connectors<=8.0.28
Oracle MySQL Enterprise Monitor<=8.0.29
Oracle MySQL Server<=8.0.29
Oracle MySQL Workbench<=8.0.28
Oracle PeopleSoft Enterprise PeopleTools=8.58
Oracle PeopleSoft Enterprise PeopleTools=8.59
Debian Debian Linux=10.0
Debian Debian Linux=11.0
NetApp OnCommand Insight
NetApp OnCommand Workflow Automation
NetApp Snapcenter
redhat/node<12.22.9
12.22.9
redhat/node<14.18.3
14.18.3
redhat/node<16.13.2
16.13.2
redhat/node<17.3.1
17.3.1
IBM Cognos Analytics<=11.2.0 - 11.2.2
IBM Cognos Analytics<=11.1.0 - 11.1.6 FP4
Node.js Node.js>=12.0.0<12.22.9, >=14.0.0<14.18.3, >=16.0.0<16.13.2, >=17.0.0<17.3.1
12.22.914.18.316.13.217.3.1
Node.js Node.js>=12.0.0<12.22.9
12.22.9
Node.js Node.js>=14.0.0<14.18.3
14.18.3
Node.js Node.js>=16.0.0<16.13.2
16.13.2
Node.js Node.js>=17.0.0<17.3.1
17.3.1
debian/nodejs<12.22.9~dfsg-1
12.22.9~dfsg-1
debian/nodejs<12.22.9~dfsg-1
12.22.9~dfsg-1
debian/nodejs<12.22.9~dfsg-1
12.22.9~dfsg-1
debian/nodejs
18.20.4+dfsg-1~deb12u218.20.4+dfsg-1~deb12u320.19.2+dfsg-1+deb13u220.19.2+dfsg-1+deb13u324.21.0+dfsg+~cs24.13.4-124.22.2+dfsg+~cs24.19.2-1
alpine/nodejs<12.22.10-r0
12.22.10-r0
alpine/nodejs<14.19.0-r0
14.19.0-r0
alpine/nodejs<14.19.0-r0
14.19.0-r0
alpine/nodejs<16.13.2-r0
16.13.2-r0
alpine/nodejs<16.13.2-r0
16.13.2-r0
alpine/nodejs<16.13.2-r0
16.13.2-r0
alpine/nodejs<16.13.2-r0
16.13.2-r0
alpine/nodejs<16.13.2-r0
16.13.2-r0
alpine/nodejs<16.13.2-r0
16.13.2-r0
alpine/nodejs<16.13.2-r0
16.13.2-r0
alpine/nodejs<16.13.2-r0
16.13.2-r0
alpine/nodejs<16.13.2-r0
16.13.2-r0
alpine/nodejs<16.13.2-r0
16.13.2-r0
alpine/nodejs-current<17.3.1-r0
17.3.1-r0
alpine/nodejs-current<17.3.1-r0
17.3.1-r0
alpine/nodejs-current<17.3.1-r0
17.3.1-r0
alpine/nodejs-current<17.3.1-r0
17.3.1-r0
alpine/nodejs-current<17.3.1-r0
17.3.1-r0
alpine/nodejs-current<17.3.1-r0
17.3.1-r0
alpine/nodejs-current<17.3.1-r0
17.3.1-r0
alpine/nodejs-current<17.3.1-r0
17.3.1-r0
alpine/nodejs-current<17.3.1-r0
17.3.1-r0
alpine/nodejs-current<17.3.1-r0
17.3.1-r0
alpine/openjdk11<11.0.15_p10-r0
11.0.15_p10-r0
alpine/openjdk11<11.0.15_p10-r0
11.0.15_p10-r0
alpine/openjdk11<11.0.15_p10-r0
11.0.15_p10-r0
alpine/openjdk11<11.0.15_p10-r0
11.0.15_p10-r0
alpine/openjdk11<11.0.15_p10-r0
11.0.15_p10-r0
alpine/openjdk11<11.0.15_p10-r0
11.0.15_p10-r0
alpine/openjdk11<11.0.15_p10-r0
11.0.15_p10-r0
alpine/openjdk11<11.0.15_p10-r0
11.0.15_p10-r0
alpine/openjdk11<11.0.15_p10-r0
11.0.15_p10-r0
alpine/openjdk11<11.0.15_p10-r0
11.0.15_p10-r0

Remediation

Recommended actions to resolve this vulnerability, in priority order.

  1. Upgrade

    Upgrade redhat/rh-nodejs12-nodejs to a version that resolves this vulnerability.

    Fixed in 0:12.22.12-2.el7
  2. Upgrade

    Upgrade redhat/rh-nodejs14-nodejs to a version that resolves this vulnerability.

    Fixed in 0:14.20.1-2.el7
  3. Upgrade

    Upgrade redhat/node to a version that resolves this vulnerability.

    Fixed in 12.22.9
  4. Upgrade

    Upgrade redhat/node to a version that resolves this vulnerability.

    Fixed in 14.18.3
  5. Upgrade

    Upgrade redhat/node to a version that resolves this vulnerability.

    Fixed in 16.13.2
  6. Upgrade

    Upgrade redhat/node to a version that resolves this vulnerability.

    Fixed in 17.3.1
  7. Upgrade

    Upgrade to a fixed release to a version that resolves this vulnerability.

    Fixed in 12.22.9Fixed in 14.18.3Fixed in 16.13.2Fixed in 17.3.1
  8. Upgrade

    Upgrade to a fixed release to a version that resolves this vulnerability.

    Fixed in 12.22.9
  9. Upgrade

    Upgrade to a fixed release to a version that resolves this vulnerability.

    Fixed in 14.18.3
  10. Upgrade

    Upgrade to a fixed release to a version that resolves this vulnerability.

    Fixed in 16.13.2
  11. Upgrade

    Upgrade to a fixed release to a version that resolves this vulnerability.

    Fixed in 17.3.1
  12. Upgrade

    Upgrade debian/nodejs to a version that resolves this vulnerability.

    Fixed in 18.20.4+dfsg-1~deb12u2Fixed in 18.20.4+dfsg-1~deb12u3Fixed in 20.19.2+dfsg-1+deb13u2Fixed in 20.19.2+dfsg-1+deb13u3Fixed in 24.21.0+dfsg+~cs24.13.4-1Fixed in 24.22.2+dfsg+~cs24.19.2-1
  13. Upgrade

    Upgrade alpine/nodejs to a version that resolves this vulnerability.

    Fixed in 12.22.10-r0
  14. Upgrade

    Upgrade alpine/nodejs to a version that resolves this vulnerability.

    Fixed in 14.19.0-r0
  15. Upgrade

    Upgrade alpine/nodejs to a version that resolves this vulnerability.

    Fixed in 16.13.2-r0
  16. Upgrade

    Upgrade alpine/nodejs-current to a version that resolves this vulnerability.

    Fixed in 17.3.1-r0
  17. Upgrade

    Upgrade alpine/openjdk11 to a version that resolves this vulnerability.

    Fixed in 11.0.15_p10-r0
  18. Upgrade

    Upgrade debian/nodejs to a version that resolves this vulnerability.

    Fixed in 12.22.9~dfsg-1

Event History

Jan 10, 2022
CVE Published
12:00 AM
Jan 11, 2022
Data Sourced
via Node.js·12:00 AM
SeverityAffected Software
Data Sourced
via Node.js·12:50 AM
Description
Jan 14, 2022
Data Sourced
via Red Hat·07:46 PM
DescriptionSeverityAffected Software
Feb 24, 2022
CVE Published
via MITRE·12:00 AM
Data Sourced
via MITRE·12:00 AM
DescriptionWeakness
Data Sourced
via NVD·07:15 PM
RemedyDescriptionSeverityWeaknessAffected Software
Data Sourced
via OSV·07:15 PM
DescriptionSeverityAffected Software
Jul 15, 2025
Data Sourced
via IBM·12:00 AM
DescriptionAffected Software

Parent advisories

This vulnerability appears in the following advisories.

Peer vulnerabilities

Found alongside the following vulnerabilities.

Frequently Asked Questions

1

What is the vulnerability ID?

The vulnerability ID is CVE-2022-21824.

2

What is the severity of CVE-2022-21824?

The severity of CVE-2022-21824 is high (8.2).

3

Which software is affected by CVE-2022-21824?

The following software are affected by CVE-2022-21824: - Node.js versions up to 12.22.9 - Node.js versions up to 14.18.3 - Node.js versions up to 16.13.2 - Node.js versions up to 17.3.1 - Rh-nodejs12-nodejs versions up to 0:12.22.12-2.el7 - Rh-nodejs14-nodejs versions up to 0:14.20.1-2.el7 - Debian Node.js version 10.24.0~dfsg-1~deb10u1 - Oracle MySQL Cluster versions up to 8.0.29 - Oracle MySQL Connectors versions up to 8.0.28 - Oracle MySQL Enterprise Monitor versions up to 8.0.29 - Oracle MySQL Server versions up to 8.0.29 - Oracle MySQL Workbench versions up to 8.0.28 - Oracle PeopleSoft Enterprise PeopleTools version 8.58 - Oracle PeopleSoft Enterprise PeopleTools version 8.59 - Debian Debian Linux version 10.0 - Debian Debian Linux version 11.0 - NetApp OnCommand Insight - NetApp OnCommand Workflow Automation - Netapp Snapcenter - IBM Cognos Analytics 11.2.x - IBM Cognos Analytics 11.1.x

4

How does CVE-2022-21824 impact Node.js?

CVE-2022-21824 impacts Node.js by allowing user-controlled input to be passed to the 'properties' parameter of the 'console.table()' function, potentially leading to prototype pollution.

5

How can CVE-2022-21824 be fixed?

To fix CVE-2022-21824, it is recommended to upgrade to the following versions: - Node.js 12.22.9 - Node.js 14.18.3 - Node.js 16.13.2 Or apply the appropriate patch provided by your software vendor.

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203