High severity7.5NVD Advisory· Published May 1, 2022· Updated Jun 17, 2026

CVE-2022-21144

Description

This affects all versions of package libxmljs. When invoking the libxmljs.parseXml function with a non-buffer argument the V8 code will attempt invoking the .toString method of the argument. If the argument's toString value is not a Function object V8 will crash.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected packages

Versions sourced from the GitHub Security Advisory.

Package	Affected versions	Patched versions
libxmljsnpm	< 0.19.8	0.19.8

Affected products

Libxmljs Project/Libxmljs
cpe:2.3:a:libxmljs_project:libxmljs:*:*:*:*:*:node.js:*:*
Range: <0.19.8
Libxmljs/Libxmljscpe-rescue
ghsa-coords
pkg:npm/libxmljs
Range: < 0.19.8

Patches

Vulnerability mechanics

References

github.com/libxmljs/libxmljs/commit/2501807bde9b38cfaed06d1e140487516d91379dnvdPatchThird Party AdvisoryWEB
github.com/libxmljs/libxmljs/pull/594nvdPatchThird Party AdvisoryWEB
snyk.io/vuln/SNYK-JS-LIBXMLJS-2348756nvdExploitThird Party AdvisoryWEB
github.com/advisories/GHSA-773h-w45w-f2f9ghsaADVISORY
nvd.nist.gov/vuln/detail/CVE-2022-21144ghsaADVISORY

News mentions

No linked articles in our index yet.

cvss	0.488
epss	0.002
exploit	0.000
kev	0.000
patch	-0.070
ransomware	0.000