CVE-2024-21528

5.9 mediumEPSS 0.6%

Medium (5.9). EPSS 0.6% chance of exploitation in the next 30 days.

All versions of the package node-gettext are vulnerable to Prototype Pollution via the addTranslations() function in gettext.js due to improper user input sanitization.

Severity

CVSS 3.1

5.9 medium

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

EPSS: 0.6% chance of exploitation in the next 30 days; higher than 47% of CVEs (scores of 2026-10-31)
CWE: CWE-1321
Published: 2024-09-10
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Packages (OSV)

Advisory	Ecosystem	Package	Affected	Fixed in
GHSA-g974-hxvm-x689	npm	node-gettext	<=3.0.0	no fix published

References

https://github.com/alexanderwallin/node-gettext/blob/65d9670f691c2eeca40dce129c95bcf8b613d344/lib/gettext.js%23L113
https://security.snyk.io/vuln/SNYK-JS-NODEGETTEXT-6100943

Check your stack JSON