Prototype Pollution in @hapi/hoek
Summary
GHSA-22h7-7wwg-qmgg: Prototype Pollution in @hapi/hoek. Affects @hapi/hoek across 2 version ranges.
>= 8.3.2, < 8.5.1
>= 9.0.0, < 9.0.3
Fixed in 8.5.1 or 9.0.3, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The @hapi/hoek package is a utility library used by the hapi framework and other applications. It provides various functions for manipulating objects, arrays, and other data structures. However, versions prior to 8.5.1 and 9.0.3 of @hapi/hoek are vulnerable to Prototype Pollution.
Vulnerability Detail
Prototype Pollution is a vulnerability that occurs when an application allows user-controlled input to modify the prototype of an object. In the case of @hapi/hoek, the clone function fails to prevent the modification of the Object prototype when passed specially-crafted input. This can lead to the modification of existing properties that exist in all objects, potentially resulting in Denial of Service or Remote Code Execution in certain scenarios. It's important to note that hapi applications are not affected by this vulnerability as the framework protects against such malicious inputs. However, applications using @hapi/hoek outside of the hapi ecosystem may be vulnerable.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 8.3.2, < 8.5.18.5.1npm install @hapi/hoek@8.5.1 -
>= 9.0.0, < 9.0.39.0.3npm install @hapi/hoek@9.0.3
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Conclusion
The Prototype Pollution vulnerability in @hapi/hoek can have serious consequences, including Denial of Service or Remote Code Execution. It is crucial to update to the recommended versions to mitigate the risk. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for @hapi/hoek →
FAQ
Prototype Pollution is a vulnerability that occurs when an application allows user-controlled input to modify the prototype of an object. This can lead to unexpected behavior and security issues.
Versions prior to 8.5.1 and 9.0.3 of @hapi/hoek are vulnerable to Prototype Pollution. The clone function fails to prevent the modification of the Object prototype when passed specially-crafted input.
No, hapi applications are not affected by this vulnerability as the framework protects against such malicious inputs.
The modification of existing properties that exist in all objects can lead to Denial of Service or Remote Code Execution in specific circumstances.
To fix this vulnerability, update to version 8.5.1, 9.0.3, or any later version of @hapi/hoek.
References
Related vulnerabilities
Recent vulnerabilities recorded for @hapi/hoek.
