CVE-2022-21803 Prototype Pollution

🗓️ 12 Apr 2022 15:20:12Reported by GoogleType

osv🔗 osv.dev👁 31 Views

CVE-2022-21803 affects nconf package before version 0.11.4, allowing modification of properties via the .set() function with nested JSON configuration when using the memory engine

Reporter	Title	Published	Views	Family All 27
IBM Security Bulletins	Security Bulletin: A security vulnerability in Node.js nconf affects IBM Cloud Pak for Multicloud Management Managed Services	19 Jul 202217:07	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Cognos Analytics has addressed multiple vulnerabilities	15 Jul 202516:38	–	ibm
IBM Security Bulletins	Security Bulletin: IBM App Connect Enterprise Certified Container operands may be vulnerable to code injection due to CVE-2022-21803	26 May 202215:04	–	ibm
IBM Security Bulletins	Security Bulletin: A security vulnerability in Node.js nconf affects IBM Cloud Automation Manager	25 Jul 202211:33	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Integration Bus and IBM App Connect Enterprise are vulnerable to arbitrary code execution due to async ( CVE-2021-43138) and nconf (CVE-2022-21803)	4 Jul 202216:02	–	ibm
ATTACKERKB	CVE-2022-21803	12 Apr 202215:19	–	attackerkb
Circl	CVE-2022-21803	12 Apr 202220:17	–	circl
CNNVD	nconf 安全漏洞	12 Apr 202200:00	–	cnnvd
CNVD	nconf has unspecified vulnerabilities	15 Apr 202200:00	–	cnvd
CVE	CVE-2022-21803	12 Apr 202215:20	–	cve

Source	Link
github	www.github.com/indexzero/nconf/releases/tag/v0.11.4
github	www.github.com/CVEProject/cvelistV5/tree/main/cves/2022/21xxx/CVE-2022-21803.json
nvd	www.nvd.nist.gov/vuln/detail/CVE-2022-21803
snyk	www.snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-2632450
snyk	www.snyk.io/vuln/SNYK-JS-NCONF-2395478
github	www.github.com/indexzero/nconf/pull/397

15 Jul 2026 01:49Current

7.1High risk

Vulners AI Score7.1

CVSS 3.17.3

EPSS0.01753