CVE-2022-25296: Prototype Pollution in bodymen
Summary
CVE-2022-2529: Cloudflare GoFlow vulnerable to a Denial of Service in the sflow packet handling package. Affects github.com/cloudflare/goflow/v3 versions < 3.4.4. Fixed in 3.4.4. How to fix ↓
Also tracked for
The same CVE-2022-2529 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The package bodymen is an npm package used for handling and validating HTTP request bodies. It provides a convenient way to define and enforce rules for request body parameters. The package is widely used in Node.js applications for handling API requests. However, versions 0.0.0 of bodymen are vulnerable to Prototype Pollution, a type of vulnerability that allows an attacker to modify or add properties to the Object.prototype using a proto payload. This vulnerability is a result of an incomplete fix for a previous vulnerability (CVE-2019-10792).
Vulnerability Detail
The Prototype Pollution vulnerability in bodymen can be exploited by an attacker to modify or add properties to the Object.prototype. This can lead to various security issues, such as bypassing security controls, injecting malicious code, or causing unexpected behavior in the application. An attacker can craft a payload that includes a proto property, which will be processed by the handler function in bodymen. By manipulating the payload, an attacker can modify the prototype of Object and introduce malicious behavior into the application.
How To Fix
Latest published version: v3.5.0 as of 23 Oct 2026
go get github.com/cloudflare/goflow/v3@v3.5.0Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
3.4.4
This is the first release that contains the fix.
go get github.com/cloudflare/goflow/v3@v3.4.4Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to upgrade to a non-vulnerable version of bodymen to mitigate the risk.
Conclusion
The Prototype Pollution vulnerability in bodymen can have severe security implications for applications using vulnerable versions of the package. It is crucial to upgrade to the latest non-vulnerable version (0.0.1) of bodymen to mitigate the risk. Regularly updating dependencies and staying informed about security vulnerabilities is essential for maintaining the security of your application. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for github.com/cloudflare/goflow/v3 →
FAQ
Prototype Pollution is a vulnerability that allows an attacker to modify or add properties to the Object.prototype. This can lead to security issues and unexpected behavior in the application.
The Prototype Pollution vulnerability in bodymen can allow an attacker to introduce malicious behavior into your application by modifying the prototype of Object. This can lead to security bypasses, code injection, and other security issues.
Yes, the maintainers of bodymen have released a fix for this vulnerability in version 0.0.1. It is recommended to upgrade to the latest version to mitigate the risk.
There are no known public exploits for this vulnerability at the moment. However, it is crucial to upgrade to a non-vulnerable version to prevent potential attacks.
You can use the Vulert Playground (https://vulert.com/scanner) to check if your application is affected by this vulnerability. Simply upload your package-lock.json file, and Vulert will analyze it for vulnerabilities, including the Prototype Pollution vulnerability in bodymen.
