critical
CVE-2021-44906
minimist: prototype pollution
In the Trivy database since at least 24 Oct 2026, 07:11 UTCWhen it arrived before that build is not recorded.
Severity by source
NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
GHSA9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Red Hat3.1CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N
Trivy's own label is CRITICAL. Rated critical by NVD, GHSA. Rated lower by Red Hat (medium), AlmaLinux (medium), Oracle (medium), Rocky Linux (medium).
Description
Minimist <=1.2.5 is vulnerable to Prototype Pollution via file index.js, function setKey() (lines 69-95).
Affected packages and fixed versions
| Source | Package | Fixed in |
|---|---|---|
| npm::GitHub Security Advisory npm | minimist | 1.2.6, 0.2.4 |
| alma 8 | nodejs:14::nodejs, nodejs:14::nodejs-devel, nodejs:14::nodejs-docs and 11 more | 1:14.21.1-2.module_el8.7.0+3373+a4c18c43 and 7 more |
| alma 9 | nodejs, nodejs-docs, nodejs-full-i18n and 3 more | 1:16.18.1-3.el9_1 and 2 more |
| debian 10 | node-minimist | 1.2.0-1+deb10u2 |
| debian 11 | node-minimist | 1.2.5+~cs5.3.1-2+deb11u1 |
| debian 12 | node-minimist | 1.2.6+~cs5.3.2-1 |
| debian 13 | node-minimist | 1.2.6+~cs5.3.2-1 |
| debian 14 | node-minimist | 1.2.6+~cs5.3.2-1 |
| debian 9 | node-minimist | no fix listed |
| echo | node-minimist | 1.2.6+~cs5.3.2-1 |
| Oracle Linux 8 | nodejs, nodejs-devel, nodejs-docs and 4 more | 1:16.18.1-3.module+el8.7.0+20893+df13f383 and 3 more |
| Oracle Linux 9 | nodejs, nodejs-docs, nodejs-full-i18n and 3 more | 1:16.18.1-3.el9_1 and 2 more |
Show all 80 entries from 17 sources
| Source | Package | Fixed in |
|---|---|---|
| npm::GitHub Security Advisory npm | minimist | 1.2.6, 0.2.4 |
| alma 8 | nodejs:14::nodejs | 1:14.21.1-2.module_el8.7.0+3373+a4c18c43 |
| alma 8 | nodejs:14::nodejs-devel | 1:14.21.1-2.module_el8.7.0+3373+a4c18c43 |
| alma 8 | nodejs:14::nodejs-docs | 1:14.21.1-2.module_el8.7.0+3373+a4c18c43 |
| alma 8 | nodejs:14::nodejs-full-i18n | 1:14.21.1-2.module_el8.7.0+3373+a4c18c43 |
| alma 8 | nodejs:14::nodejs-nodemon | 2.0.20-2.module_el8.7.0+3373+a4c18c43 |
| alma 8 | nodejs:14::nodejs-packaging | 23-3.module_el8.4.0+2522+3bd42762 |
| alma 8 | nodejs:14::npm | 1:6.14.17-1.14.21.1.2.module_el8.7.0+3373+a4c18c43 |
| alma 8 | nodejs:16::nodejs | 1:16.18.1-3.module_el8.7.0+3371+ed8c43db |
| alma 8 | nodejs:16::nodejs-devel | 1:16.18.1-3.module_el8.7.0+3371+ed8c43db |
| alma 8 | nodejs:16::nodejs-docs | 1:16.18.1-3.module_el8.7.0+3371+ed8c43db |
| alma 8 | nodejs:16::nodejs-full-i18n | 1:16.18.1-3.module_el8.7.0+3371+ed8c43db |
| alma 8 | nodejs:16::nodejs-nodemon | 2.0.20-2.module_el8.7.0+3371+ed8c43db |
| alma 8 | nodejs:16::nodejs-packaging | 25-1.module_el8.5.0+2605+45d748af |
| alma 8 | nodejs:16::npm | 1:8.19.2-1.16.18.1.3.module_el8.7.0+3371+ed8c43db |
| alma 9 | nodejs | 1:16.18.1-3.el9_1 |
| alma 9 | nodejs-docs | 1:16.18.1-3.el9_1 |
| alma 9 | nodejs-full-i18n | 1:16.18.1-3.el9_1 |
| alma 9 | nodejs-libs | 1:16.18.1-3.el9_1 |
| alma 9 | nodejs-nodemon | 2.0.20-2.el9_1 |
| alma 9 | npm | 1:8.19.2-1.16.18.1.3.el9_1 |
| debian 10 | node-minimist | 1.2.0-1+deb10u2 |
| debian 11 | node-minimist | 1.2.5+~cs5.3.1-2+deb11u1 |
| debian 12 | node-minimist | 1.2.6+~cs5.3.2-1 |
| debian 13 | node-minimist | 1.2.6+~cs5.3.2-1 |
| debian 14 | node-minimist | 1.2.6+~cs5.3.2-1 |
| debian 9 | node-minimist | no fix listed |
| echo | node-minimist | 1.2.6+~cs5.3.2-1 |
| Oracle Linux 8 | nodejs | 1:16.18.1-3.module+el8.7.0+20893+df13f383 |
| Oracle Linux 8 | nodejs-devel | 1:16.18.1-3.module+el8.7.0+20893+df13f383 |
| Oracle Linux 8 | nodejs-docs | 1:16.18.1-3.module+el8.7.0+20893+df13f383 |
| Oracle Linux 8 | nodejs-full-i18n | 1:16.18.1-3.module+el8.7.0+20893+df13f383 |
| Oracle Linux 8 | nodejs-nodemon | 2.0.20-2.module+el8.7.0+20895+79a25710 |
| Oracle Linux 8 | nodejs-packaging | 25-1.module+el8.5.0+20388+4b61e68d |
| Oracle Linux 8 | npm | 1:8.19.2-1.16.18.1.3.module+el8.7.0+20893+df13f383 |
| Oracle Linux 9 | nodejs | 1:16.18.1-3.el9_1 |
| Oracle Linux 9 | nodejs-docs | 1:16.18.1-3.el9_1 |
| Oracle Linux 9 | nodejs-full-i18n | 1:16.18.1-3.el9_1 |
| Oracle Linux 9 | nodejs-libs | 1:16.18.1-3.el9_1 |
| Oracle Linux 9 | nodejs-nodemon | 2.0.20-2.el9_1 |
| Oracle Linux 9 | npm | 1:8.19.2-1.16.18.1.3.el9_1 |
| rapidfort Oracle Linux 9 | nodejs | 1:16.18.1-3.el9_1 |
| rapidfort Oracle Linux 9 | nodejs-docs | 1:16.18.1-3.el9_1 |
| rapidfort Oracle Linux 9 | nodejs-full-i18n | 1:16.18.1-3.el9_1 |
| rapidfort Oracle Linux 9 | nodejs-libs | 1:16.18.1-3.el9_1 |
| rapidfort Oracle Linux 9 | nodejs-nodemon | 0:2.0.20-2.el9_1 |
| rapidfort Oracle Linux 9 | npm | 1:8.19.2-1.16.18.1.3.el9_1 |
| rapidfort rocky 9 | nodejs | 1:16.18.1-3.el9_1 |
| Red Hat | nodejs:12::nodejs | no fix listed |
| Red Hat | nodejs:12::nodejs-devel | no fix listed |
| Red Hat | nodejs:12::nodejs-docs | no fix listed |
| Red Hat | nodejs:12::nodejs-full-i18n | no fix listed |
| Red Hat | nodejs:12::nodejs-libs | no fix listed |
| Red Hat | nodejs:12::nodejs-nodemon | no fix listed |
| Red Hat | nodejs:12::nodejs-packaging | no fix listed |
| Red Hat | nodejs:12::nodejs-packaging-bundler | no fix listed |
| Red Hat | nodejs:12::npm | no fix listed |
| Red Hat | nodejs:12::v8-12.4-devel | no fix listed |
| Red Hat | nodejs:12::v8-13.6-devel | no fix listed |
| Red Hat | tfm-rubygem-rabl | no fix listed |
| rocky 8 | nodejs:14::nodejs | 1:14.21.1-2.module+el8.7.0+1116+bd2a84b4 |
| rocky 8 | nodejs:14::nodejs-devel | 1:14.21.1-2.module+el8.7.0+1116+bd2a84b4 |
| rocky 8 | nodejs:14::nodejs-docs | 1:14.21.1-2.module+el8.7.0+1116+bd2a84b4 |
| rocky 8 | nodejs:14::nodejs-full-i18n | 1:14.21.1-2.module+el8.7.0+1116+bd2a84b4 |
| rocky 8 | nodejs:14::nodejs-nodemon | 2.0.20-2.module+el8.7.0+1108+49363b0d |
| rocky 8 | nodejs:14::nodejs-packaging | 23-3.module+el8.7.0+1071+4bdda2a8 |
| rocky 8 | nodejs:14::npm | 1:6.14.17-1.14.21.1.2.module+el8.7.0+1116+bd2a84b4 |
| rocky 8 | nodejs:16::nodejs | 1:16.18.1-3.module+el8.7.0+1108+49363b0d |
| rocky 8 | nodejs:16::nodejs-devel | 1:16.18.1-3.module+el8.7.0+1108+49363b0d |
| rocky 8 | nodejs:16::nodejs-docs | 1:16.18.1-3.module+el8.7.0+1108+49363b0d |
| rocky 8 | nodejs:16::nodejs-full-i18n | 1:16.18.1-3.module+el8.7.0+1108+49363b0d |
| rocky 8 | nodejs:16::nodejs-nodemon | 2.0.20-2.module+el8.7.0+1108+49363b0d |
| rocky 8 | nodejs:16::nodejs-packaging | 25-1.module+el8.6.0+1046+80feca58 |
| rocky 8 | nodejs:16::npm | 1:8.19.2-1.16.18.1.3.module+el8.7.0+1108+49363b0d |
| rocky 9 | nodejs | 1:16.18.1-3.el9_1 |
| rocky 9 | nodejs-docs | 1:16.18.1-3.el9_1 |
| rocky 9 | nodejs-full-i18n | 1:16.18.1-3.el9_1 |
| rocky 9 | nodejs-libs | 1:16.18.1-3.el9_1 |
| rocky 9 | nodejs-nodemon | 2.0.20-2.el9_1 |
| rocky 9 | npm | 1:8.19.2-1.16.18.1.3.el9_1 |
References
- https://access.redhat.com/errata/RHSA-2023:0321
- https://access.redhat.com/security/cve/CVE-2021-44906
- https://bugzilla.redhat.com/2066009
- https://bugzilla.redhat.com/2130518
- https://bugzilla.redhat.com/2134609
- https://bugzilla.redhat.com/2140911
- https://bugzilla.redhat.com/show_bug.cgi?id=2066009
- https://bugzilla.redhat.com/show_bug.cgi?id=2130518
All 38 references
- https://bugzilla.redhat.com/show_bug.cgi?id=2134609
- https://bugzilla.redhat.com/show_bug.cgi?id=2140911
- https://bugzilla.redhat.com/show_bug.cgi?id=2142808
- https://creativecommons.org/licenses/by/4.0/
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-44906
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-3517
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-35256
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-43548
- https://errata.almalinux.org/9/ALSA-2023-0321.html
- https://errata.rockylinux.org/RLSA-2023:0321
- https://github.com/Marynk/JavaScript-vulnerability-detection/blob/main/minimist%20PoC.zip
- https://github.com/advisories/GHSA-xvch-5gv4-984h
- https://github.com/minimistjs/minimist/commit/34e20b8461118608703d6485326abbb8e35e1703
- https://github.com/minimistjs/minimist/commit/bc8ecee43875261f4f17eb20b1243d3ed15e70eb
- https://github.com/minimistjs/minimist/commit/c2b981977fa834b223b408cfb860f933c9811e4d
- https://github.com/minimistjs/minimist/commit/ef9153fc52b6cea0744b2239921c5dcae4697f11
- https://github.com/minimistjs/minimist/commits/v0.2.4
- https://github.com/minimistjs/minimist/issues/11
- https://github.com/minimistjs/minimist/pull/24
- https://github.com/substack/minimist
- https://github.com/substack/minimist/blob/master/index.js#L69
- https://github.com/substack/minimist/issues/164
- https://linux.oracle.com/cve/CVE-2021-44906.html
- https://linux.oracle.com/errata/ELSA-2023-0321.html
- https://nvd.nist.gov/vuln/detail/CVE-2021-44906
- https://security.netapp.com/advisory/ntap-20240621-0006
- https://security.netapp.com/advisory/ntap-20240621-0006/
- https://snyk.io/vuln/SNYK-JS-MINIMIST-559764
- https://stackoverflow.com/questions/8588563/adding-custom-properties-to-a-function/20278068#20278068
- https://www.cve.org/CVERecord?id=CVE-2021-44906