CVE-2021-44906: Prototype Pollution in minimist
Summary
CVE-2021-44906: Prototype Pollution in minimist. Affects minimist across 2 version ranges.
< 0.2.4
>= 1.0.0, < 1.2.6
Fixed in 0.2.4 or 1.2.6, depending on the release line you run. How to fix ↓
Also tracked for
- node-minimist · Debian:11
The same CVE-2021-44906 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
minimist is an npm package that provides a lightweight command-line argument parser. It is commonly used in Node.js applications to parse command-line arguments and options. The package allows developers to easily handle command-line inputs and extract relevant information. However, versions prior to 1.2.6 and 0.2.4 of minimist are vulnerable to Prototype Pollution.
Vulnerability Detail
Prototype Pollution is a vulnerability that occurs when an attacker can modify the prototype of an object and inject malicious properties or methods. In the case of minimist, the vulnerability exists in the index.js file, specifically in the setKey() function (lines 69-95). This function does not properly validate user input, allowing an attacker to manipulate the prototype chain and potentially execute arbitrary code. An attacker could exploit this vulnerability to modify the behavior of the affected application, leading to various security risks such as remote code execution, information disclosure, or denial of service.
How To Fix
Latest published version: 1.2.8 as of 23 Oct 2026
npm install minimist@1.2.8Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 0.2.40.2.4npm install minimist@0.2.4 -
>= 1.0.0, < 1.2.61.2.6npm install minimist@1.2.6
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
If updating the minimist package is not immediately feasible, developers can implement a workaround to mitigate the risk of exploitation. One possible workaround is to manually validate and sanitize command-line inputs before passing them to minimist. This can be done by implementing custom input validation logic or using a trusted input validation library. By ensuring that only safe and expected values are processed by minimist, the risk of prototype pollution attacks can be reduced.
Conclusion
Prototype Pollution in minimist (CVE-2021-44906) is a critical vulnerability that allows attackers to manipulate the prototype chain and potentially execute arbitrary code. It is crucial for developers to update their minimist package to version 1.2.6 or later to mitigate this vulnerability. Implementing input validation and regularly updating dependencies are also recommended security practices. For further assistance or support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for minimist →
FAQ
minimist is an npm package that provides a lightweight command-line argument parser for Node.js applications.
Prototype Pollution is a vulnerability that allows an attacker to modify the prototype of an object and inject malicious properties or methods.
The impact of this vulnerability can vary depending on the attacker's intentions, but it could lead to remote code execution, information disclosure, or denial of service.
To fix this vulnerability, update the minimist package to version 1.2.6 or later using the command npm install minimist@latest.
If updating the minimist package is not immediately feasible, you can manually validate and sanitize command-line inputs before passing them to minimist.
References
Related vulnerabilities
Recent vulnerabilities recorded for minimist.
