GHSA-c429-5p7v-vgjp
hoek subject to prototype pollution via the clone function.
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| npm | @hapi/hoek | < 8.5.1 | 8.5.1 |
| npm | @hapi/hoek | >= 9.0.0, < 9.0.3 | 9.0.3 |
| npm | hoek | <= 6.1.3 | no fix listed |
Details
As written in the advisory (Markdown source, shown as plain text).
hoek versions prior to 8.5.1, and 9.x prior to 9.0.3 are vulnerable to prototype pollution in the clone function. If an object with the __proto__ key is passed to clone() the key is converted to a prototype. This issue has been patched in version 9.0.3, and backported to 8.5.1.
References
External links from the advisory. They lead to third-party sites.