p PatchFirst

CVE-2022-46164

CVE-2022-46164 · Account takeover via prototype vulnerability

This page contains facts from public vulnerability sources. Check the original advisory before updating.

NodeBB is an open source Node.js based forum software. Due to a plain object with a prototype being used in socket.io message handling a specially crafted payload can be used to impersonate other users and takeover accounts. This vulnerability has been patched in version 2.6.1. Users are advised to upgrade. Users unable to upgrade may cherry-pick commit `48d143921753914da45926cca6370a92ed0c46b8` into their codebase to patch the exploit.

CVSS 9.4 · Critical · EPSS 47.4% · Fix available

Published
Updated

Stack: node

Affected products and versions

  • nodebb

    Versions
    • < 2.6.1: Affected

    No fix published

  • nodebb npm

    Affected ranges
    • SEMVER: < 2.6.1

    Update to 2.6.1

Original sources

Check your server →