CVE-2022-21824: 
MySQL vulnerability analysis and mitigation

Due to the formatting logic of the console.table() function in Node.js, a vulnerability was discovered where user-controlled input passed to the 'properties' parameter, combined with a plain object containing at least one property as the first parameter (which could be 'proto'), could lead to prototype pollution. The vulnerability (CVE-2022-21824) was discovered in January 2022 and affected all versions of Node.js 12.x, 14.x, 16.x, and 17.x release lines prior to versions 12.22.9, 14.18.3, 16.13.2, and 17.3.1 (Node.js Blog).

The prototype pollution vulnerability has very limited control, only allowing an empty string to be assigned to numerical keys of the object prototype. The issue was addressed in Node.js versions >= 12.22.9, >= 14.18.3, >= 16.13.2, and >= 17.3.1 by implementing a null prototype for the object these properties are being assigned to. The vulnerability has been assigned a CVSS v3.1 base score of 8.2 (HIGH) with the vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H (NVD).

The vulnerability could allow attackers to perform prototype pollution, though with limited control. The impact is restricted to assigning empty strings to numerical keys of the object prototype, which could potentially affect application behavior and lead to high availability impact with low integrity impact (NVD).

The vulnerability is remotely exploitable without requiring authentication. It requires low attack complexity and no user interaction, making it relatively straightforward to exploit within its limited scope (NVD).

The primary mitigation is to upgrade to the fixed versions of Node.js: version 12.22.9 or later for the 12.x series, 14.18.3 or later for the 14.x series, 16.13.2 or later for the 16.x series, or 17.3.1 or later for the 17.x series. The fix implements a null prototype for the object these properties are being assigned to (Node.js Blog).

The vulnerability was reported by Patrik Oldsberg (rugvip) and was addressed promptly in the January 2022 security releases. Multiple organizations including Debian, Oracle, and NetApp issued advisories and patches for their products that incorporate Node.js (Debian Security, Oracle Security, NetApp Security).