CVE-2022-21803

This affects the package nconf before 0.11.4. When using the memory engine, it is possible to store a nested JSON representation of the configuration. The .set() function, that is responsible for setting the configuration properties, is vulnerable to Prototype Pollution. By providing a crafted property, it is possible to modify the properties on the Object.prototype.

• CWE-1321

• https://github.com/indexzero/nconf/pull/397Issue Tracking, Patch, Third Party Advisory
• https://github.com/indexzero/nconf/releases/tag/v0.11.4Release Notes, Third Party Advisory
• https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-2632450Exploit, Third Party Advisory
• https://snyk.io/vuln/SNYK-JS-NCONF-2395478Exploit, Third Party Advisory
• https://github.com/indexzero/nconf/pull/397Issue Tracking, Patch, Third Party Advisory
• https://github.com/indexzero/nconf/releases/tag/v0.11.4Release Notes, Third Party Advisory
• https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-2632450Exploit, Third Party Advisory
• https://snyk.io/vuln/SNYK-JS-NCONF-2395478Exploit, Third Party Advisory

Published

Apr 12, 2022

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-21798The affected product is vulnerable due to cleartext transmis…9.8
• CVE-2022-21799Cross-site scripting vulnerability in ELECOM LAN router WRC-…5.2
• CVE-2022-2180The GREYD.SUITE WordPress theme does not properly validate u…9.8
• CVE-2022-21800MMP: All versions prior to v1.0.3, PTP C-series: Device vers…6.5
• CVE-2022-21801A denial of service vulnerability exists in the netserver re…7.5
• CVE-2022-21802The package grapesjs before 0.19.5 are vulnerable to Cross-s…6.1
• CVE-2022-21804Out-of-bounds write in software for the Intel QAT Driver for…7.8
• CVE-2022-21805Reflected cross-site scripting vulnerability in the attached…6.1
• CVE-2022-21806A use-after-free vulnerability exists in the mips_collector …9.8
• CVE-2022-21807Uncontrolled search path elements in the Intel(R) VTune(TM) …7.8
• CVE-2022-21808Path traversal vulnerability exists in CAMS for HIS Server c…8.8
• CVE-2022-21809A file write vulnerability exists in the httpd upload.cgi fu…8.1