Packages / minimist / Security

CriticalVulnerabilityGHSA-xvch-5gv4-984hCVE-2021-44906Published 18 Mar 2022

Prototype Pollution in minimist

Your version

Affected releases · minimist

  • 1.x1.0.0 – 1.2.5Fixed in 1.2.6
  • 0.2.x0.2.0 – 0.2.3Fixed in 0.2.4
  • 0.1.x and older0.0.0 – 0.1.0No fix, no longer updated

On 1.x, the newest line:

npm install minimist@1.2.6
Every release on a timeline
1.x

  1. Affected

    1.0.0 – 1.2.5

    11 releases

  2. Fixed

    1.2.6 – 1.2.8

    3 releases, latest

0.x

  1. Affected

    0.0.0 – 0.2.3

    16 releases

  2. Fixed

    0.2.4

    1 release

31 stable releases of minimist, oldest to newest, one row per major.

What happens

Minimist prior to 1.2.6 and 0.2.4 is vulnerable to Prototype Pollution via file index.js, function setKey() (lines 69-95).