# CVE-2022-21824: Node.js 14 and 3 others: Modification of Assumed-Immutable Data (MAID) (CWE-471)

CVE-2022-21824 is fixed in 16 products on 2 platforms, first by Node.js 12 12.22.9, released January 10, 2022. It is not reported as exploited. Patch Radar priority: High.

- Web page: https://patchblox.com/security/cve/CVE-2022-21824
- Priority: High
- CVSS: 9.8 (Moderate)
- EPSS: 0.2151
- CISA KEV: not listed
- Exploited (vendor report): no
- Publicly disclosed: no
- Published: Feb 24, 2022
- Weakness: CWE-471: Modification of Assumed-Immutable Data (MAID) (CWE-471)
- Vendor advisory: https://nvd.nist.gov/vuln/detail/CVE-2022-21824

## Description

Due to the formatting logic of the "console.table()" function it was not safe to allow user controlled input to be passed to the "properties" parameter while simultaneously passing a plain object with at least one property as the first parameter, which could be "__proto__". The prototype pollution has very limited control, in that it only allows an empty string to be assigned to numerical keys of the object prototype.Node.js >= 12.22.9, >= 14.18.3, >= 16.13.2, and >= 17.3.1 use a null protoype for the object these properties are being assigned to.

## Where it's fixed

| Platform | Product | Fixed in | Fix | Released |
|---|---|---|---|---|
| Windows apps | Node.js 12 | 12.22.9 | [Node.js 12 12.22.9](https://patchblox.com/security/data/fix/windows-app/openjs.nodejs.12-12.22.9.md) | Jan 10, 2022 |
| Windows apps | Node.js 14 | 14.18.3 | [Node.js 14 14.18.3](https://patchblox.com/security/data/fix/windows-app/openjs.nodejs.14-14.18.3.md) | Jan 10, 2022 |
| Windows apps | Node.js 16 | 16.13.2 | [Node.js 16 16.13.2](https://patchblox.com/security/data/fix/windows-app/openjs.nodejs.16-16.13.2.md) | Jan 10, 2022 |
| Windows apps | Node.js 17 | 17.3.1 | [Node.js 17 17.3.1](https://patchblox.com/security/data/fix/windows-app/openjs.nodejs.17-17.3.1.md) | Jan 10, 2022 |
| Linux | nodejs Debian 12.15 (bookworm) | 12.22.9~dfsg-1 | [DEBIAN-CVE-2022-21824](https://patchblox.com/security/data/fix/linux/debian-cve-2022-21824.md) | Feb 24, 2022 |
| Linux | nodejs Debian 13.5 (trixie) | 12.22.9~dfsg-1 | [DEBIAN-CVE-2022-21824](https://patchblox.com/security/data/fix/linux/debian-cve-2022-21824.md) | Feb 24, 2022 |
| Linux | nodejs Debian 14 | 12.22.9~dfsg-1 | [DEBIAN-CVE-2022-21824](https://patchblox.com/security/data/fix/linux/debian-cve-2022-21824.md) | Feb 24, 2022 |
| Linux | nodejs RHEL 8 | 1:16.18.1-3.module+el8.7.0+17465+1a1abd74 | [RHSA-2022:9073](https://patchblox.com/security/data/fix/linux/rhsa-2022-9073.md) | Dec 15, 2022 |
| Linux | nodejs almalinux 8 | 1:16.18.1-3.module_el8.7.0+3371+ed8c43db | [ALSA-2022:9073](https://patchblox.com/security/data/fix/linux/alsa-2022-9073.md) | Dec 15, 2022 |
| Linux | nodejs amzn 2023 | 1:18.12.1-1.amzn2023.0.2 | [ALAS2023-2023-084](https://patchblox.com/security/data/fix/linux/alas2023-2023-084.md) | Feb 17, 2023 |
| Linux | nodejs ol 8 | 1:16.18.1-3.module+el8.7.0+20893+df13f383 | [ELSA-2022-9073-1](https://patchblox.com/security/data/fix/linux/elsa-2022-9073-1.md) | Dec 16, 2022 |
| Linux | nodejs rocky 8 | 1:16.18.1-3.module+el8.7.0+1108+49363b0d | [RLSA-2022:9073](https://patchblox.com/security/data/fix/linux/rlsa-2022-9073.md) | Dec 15, 2022 |
| Linux | nodejs-debuginfo amzn 2023 | 1:18.12.1-1.amzn2023.0.2 | [ALAS2023-2023-084](https://patchblox.com/security/data/fix/linux/alas2023-2023-084.md) | Feb 17, 2023 |
| Linux | nodejs-debugsource amzn 2023 | 1:18.12.1-1.amzn2023.0.2 | [ALAS2023-2023-084](https://patchblox.com/security/data/fix/linux/alas2023-2023-084.md) | Feb 17, 2023 |
| Linux | nodejs-devel RHEL 8 | 1:16.18.1-3.module+el8.7.0+17465+1a1abd74 | [RHSA-2022:9073](https://patchblox.com/security/data/fix/linux/rhsa-2022-9073.md) | Dec 15, 2022 |
| Linux | nodejs-devel almalinux 8 | 1:16.18.1-3.module_el8.7.0+3371+ed8c43db | [ALSA-2022:9073](https://patchblox.com/security/data/fix/linux/alsa-2022-9073.md) | Dec 15, 2022 |
| Linux | nodejs-devel amzn 2023 | 1:18.12.1-1.amzn2023.0.2 | [ALAS2023-2023-084](https://patchblox.com/security/data/fix/linux/alas2023-2023-084.md) | Feb 17, 2023 |
| Linux | nodejs-devel ol 8 | 1:16.18.1-3.module+el8.7.0+20893+df13f383 | [ELSA-2022-9073-1](https://patchblox.com/security/data/fix/linux/elsa-2022-9073-1.md) | Dec 16, 2022 |
| Linux | nodejs-docs RHEL 8 | 1:16.18.1-3.module+el8.7.0+17465+1a1abd74 | [RHSA-2022:9073](https://patchblox.com/security/data/fix/linux/rhsa-2022-9073.md) | Dec 15, 2022 |
| Linux | nodejs-docs almalinux 8 | 1:16.18.1-3.module_el8.7.0+3371+ed8c43db | [ALSA-2022:9073](https://patchblox.com/security/data/fix/linux/alsa-2022-9073.md) | Dec 15, 2022 |
| Linux | nodejs-docs amzn 2023 | 1:18.12.1-1.amzn2023.0.2 | [ALAS2023-2023-084](https://patchblox.com/security/data/fix/linux/alas2023-2023-084.md) | Feb 17, 2023 |
| Linux | nodejs-docs ol 8 | 1:16.18.1-3.module+el8.7.0+20893+df13f383 | [ELSA-2022-9073-1](https://patchblox.com/security/data/fix/linux/elsa-2022-9073-1.md) | Dec 16, 2022 |
| Linux | nodejs-full-i18n RHEL 8 | 1:16.18.1-3.module+el8.7.0+17465+1a1abd74 | [RHSA-2022:9073](https://patchblox.com/security/data/fix/linux/rhsa-2022-9073.md) | Dec 15, 2022 |
| Linux | nodejs-full-i18n almalinux 8 | 1:16.18.1-3.module_el8.7.0+3371+ed8c43db | [ALSA-2022:9073](https://patchblox.com/security/data/fix/linux/alsa-2022-9073.md) | Dec 15, 2022 |
| Linux | nodejs-full-i18n amzn 2023 | 1:18.12.1-1.amzn2023.0.2 | [ALAS2023-2023-084](https://patchblox.com/security/data/fix/linux/alas2023-2023-084.md) | Feb 17, 2023 |
| Linux | nodejs-full-i18n ol 8 | 1:16.18.1-3.module+el8.7.0+20893+df13f383 | [ELSA-2022-9073-1](https://patchblox.com/security/data/fix/linux/elsa-2022-9073-1.md) | Dec 16, 2022 |
| Linux | nodejs-libs amzn 2023 | 1:18.12.1-1.amzn2023.0.2 | [ALAS2023-2023-084](https://patchblox.com/security/data/fix/linux/alas2023-2023-084.md) | Feb 17, 2023 |
| Linux | nodejs-libs-debuginfo amzn 2023 | 1:18.12.1-1.amzn2023.0.2 | [ALAS2023-2023-084](https://patchblox.com/security/data/fix/linux/alas2023-2023-084.md) | Feb 17, 2023 |
| Linux | nodejs-nodemon RHEL 8 | 0:2.0.20-2.module+el8.7.0+17412+bb0e4a6b | [RHSA-2022:9073](https://patchblox.com/security/data/fix/linux/rhsa-2022-9073.md) | Dec 15, 2022 |
| Linux | nodejs-nodemon almalinux 8 | 2.0.20-2.module_el8.7.0+3371+ed8c43db | [ALSA-2022:9073](https://patchblox.com/security/data/fix/linux/alsa-2022-9073.md) | Dec 15, 2022 |
| Linux | nodejs-nodemon ol 8 | 0:2.0.20-2.module+el8.7.0+20893+df13f383 | [ELSA-2022-9073-1](https://patchblox.com/security/data/fix/linux/elsa-2022-9073-1.md) | Dec 16, 2022 |
| Linux | nodejs-nodemon rocky 8 | 0:2.0.20-2.module+el8.7.0+1108+49363b0d | [RLSA-2022:9073](https://patchblox.com/security/data/fix/linux/rlsa-2022-9073.md) | Dec 15, 2022 |
| Linux | nodejs-packaging RHEL 8 | 0:25-1.module+el8.5.0+10992+fac5fe06 | [RHSA-2022:9073](https://patchblox.com/security/data/fix/linux/rhsa-2022-9073.md) | Dec 15, 2022 |
| Linux | nodejs-packaging almalinux 8 | 25-1.module_el8.5.0+2605+45d748af | [ALSA-2022:9073](https://patchblox.com/security/data/fix/linux/alsa-2022-9073.md) | Dec 15, 2022 |
| Linux | nodejs-packaging ol 8 | 0:25-1.module+el8.5.0+20388+4b61e68d | [ELSA-2022-9073-1](https://patchblox.com/security/data/fix/linux/elsa-2022-9073-1.md) | Dec 16, 2022 |
| Linux | nodejs-packaging rocky 8 | 0:25-1.module+el8.6.0+1046+80feca58 | [RLSA-2022:9073](https://patchblox.com/security/data/fix/linux/rlsa-2022-9073.md) | Dec 15, 2022 |
| Linux | npm RHEL 8 | 1:8.19.2-1.16.18.1.3.module+el8.7.0+17465+1a1abd74 | [RHSA-2022:9073](https://patchblox.com/security/data/fix/linux/rhsa-2022-9073.md) | Dec 15, 2022 |
| Linux | npm almalinux 8 | 1:8.19.2-1.16.18.1.3.module_el8.7.0+3371+ed8c43db | [ALSA-2022:9073](https://patchblox.com/security/data/fix/linux/alsa-2022-9073.md) | Dec 15, 2022 |
| Linux | npm amzn 2023 | 1:8.19.2-1.18.12.1.1.amzn2023.0.2 | [ALAS2023-2023-084](https://patchblox.com/security/data/fix/linux/alas2023-2023-084.md) | Feb 17, 2023 |
| Linux | npm ol 8 | 1:8.19.2-1.16.18.1.3.module+el8.7.0+20893+df13f383 | [ELSA-2022-9073-1](https://patchblox.com/security/data/fix/linux/elsa-2022-9073-1.md) | Dec 16, 2022 |
| Linux | v8-devel amzn 2023 | 2:10.2.154.15-1.18.12.1.1.amzn2023.0.2 | [ALAS2023-2023-084](https://patchblox.com/security/data/fix/linux/alas2023-2023-084.md) | Feb 17, 2023 |

---

Data as of 2026-11-08T19:12:23Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo

Free to use with attribution: show "Data: Patchblox Patch Radar" with a link to https://patchblox.com/security/patch-radar. Terms, including what needs a written agreement: https://patchblox.com/security/patch-radar/use-the-data

Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.