CVE-2022-37598
Prototype pollution vulnerability in function DEFNODE in ast.js in mishoo UglifyJS 3.13.2 via the...
Prototype pollution vulnerability in function DEFNODE in ast.js in mishoo UglifyJS 3.13.2 via the name variable in ast.js. NOTE: the vendor considers this an invalid report.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
Prototype pollution vulnerability in function DEFNODE in ast.js in mishoo UglifyJS 3.13.2 via the name variable in ast.js. NOTE: the vendor considers this an invalid report.
- Record
CVE-2022-37598- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-1321
- Updated
- 2026-11-02
CVE List No score
Prototype pollution vulnerability in function DEFNODE in ast.js in mishoo UglifyJS 3.13.2 via the name variable in ast.js. NOTE: the vendor considers this an invalid report.
- Record
CVE-2022-37598- Updated
- 2026-11-02
EUVDEUVD-2022-40223 No score
Prototype pollution vulnerability in function DEFNODE in ast.js in mishoo UglifyJS 3.13.2 via the name variable in ast.js. NOTE: the vendor considers this an invalid report.
- Record
EUVD-2022-40223- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-wx5g-37jh-9gcr
Prototype pollution vulnerability in function DEFNODE in ast.js in mishoo UglifyJS 3.13.2 via the...
Prototype pollution vulnerability in function DEFNODE in ast.js in mishoo UglifyJS 3.13.2 via the name variable in ast.js.
- Record
GHSA-wx5g-37jh-9gcr- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-1321
- Updated
- 2026-11-02
OSVAZL-44541
CVE-2022-37598 affecting package js-jquery 3.5.0-4
Prototype pollution vulnerability in function DEFNODE in ast.js in mishoo UglifyJS 3.13.2 via the name variable in ast.js. NOTE: the vendor considers this an invalid report.
- Record
AZL-44541- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-05
OSVDEBIAN-CVE-2022-37598
Prototype pollution vulnerability in function DEFNODE in ast.js in mishoo UglifyJS 3.13.2 via the name variable in ast.js. NOTE: the vendor considers this an invalid report.
- Record
DEBIAN-CVE-2022-37598- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-03
OSV No score
Prototype pollution vulnerability in function DEFNODE in ast.js in mishoo UglifyJS 3.13.2 via the name variable in ast.js. NOTE: the vendor considers this an invalid report.
- Record
CVE-2022-37598- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
js-jqueryAzure Linux:3 |
through 3.5.0-4 | None known |
uglify-jsDebian:12 |
All versions, plus listed versions 3.17.4-23.17.4-33.19.3-13.19.3-2 |
None known |
uglify-jsDebian:13 |
All versions, plus listed versions 3.17.4-23.17.4-33.19.3-13.19.3-2 |
None known |
uglify-jsDebian:14 |
All versions, plus listed versions 3.17.4-23.17.4-33.19.3-13.19.3-2 |
None known |
uglifyjsDebian:13 |
All versions, plus listed versions 2.8.29-82.8.29-8+deb13u12.8.29-93.3.10-1 |
None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| facts | OSV | |
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2022-37598 is a critical vulnerability (CVSS 9.8) in Uglifyjs Project Uglifyjs, published October 20, 2022. Its validity is disputed. EPSS puts the chance of exploitation in the next 30 days at 1.99%, the 80th percentile.
References
github.com/mishoo/UglifyJS/blob/352a944868b09c9ce3121a49d4a0bf0afe370a35/lib/ast.js
nvd.nist.gov/vuln/detail/CVE-2022-37598
security-tracker.debian.org/tracker/CVE-2022-37598