CVE-2021-44906: Substack Minimist

Critical severity, CVSS 9.8. EPSS: 4.6% chance of exploitation in the next 30 days.

Minimist <=1.2.5 is vulnerable to Prototype Pollution via file index.js, function setKey() (lines 69-95).

Affected products

• Substack Minimist: before 1.2.6 (fixed in 1.2.6)

Published 2022-03-17. Last modified 2026-10-08.