diff --git a/pkgs/development/interpreters/lua-5/default.nix b/pkgs/development/interpreters/lua-5/default.nix
index a160ee039f3a..97e444ded903 100644
--- a/pkgs/development/interpreters/lua-5/default.nix
+++ b/pkgs/development/interpreters/lua-5/default.nix
@@ -17,6 +17,13 @@ rec {
           extraPrefix = "src/";
           excludes = [ "src/testes/*" ];
         })
+        (fetchpatch {
+          name = "CVE-2022-33099.patch";
+          url = "https://github.com/lua/lua/commit/42d40581dd919fb134c07027ca1ce0844c670daf.patch";
+          sha256 = "sha256-qj1Dq1ojVoknALSa67jhgH3G3Kk4GtJP6ROFElVF+D0=";
+          stripLen = 1;
+          extraPrefix = "src/";
+        })
       ];
   };