Prototype Pollution in @hapi/subtext
Summary
GHSA-g9cg-h3jm-cwrc: Prototype Pollution in @hapi/subtext. Affects @hapi/subtext across 2 version ranges.
< 6.1.3
>= 7.0.0, < 7.0.3
Fixed in 6.1.3 or 7.0.3, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The @hapi/subtext package is a part of the Hapi ecosystem and is used for parsing and handling multipart payloads in Node.js applications. It provides functionality to extract data from multipart requests and validate the payload against defined rules.
Vulnerability Detail
Versions of @hapi/subtext prior to 6.1.3 or 7.0.3 are vulnerable to Prototype Pollution. This vulnerability occurs when a multipart payload is constructed in a way that allows one of the parts' content to be set as the entire payload object's prototype. If this prototype contains data, it may bypass other validation rules that enforce access and privacy. Additionally, if the prototype evaluates to null, it can cause unhandled exceptions when the request payload is accessed.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 6.1.36.1.3npm install @hapi/subtext@6.1.3 -
>= 7.0.0, < 7.0.37.0.3npm install @hapi/subtext@7.0.3
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Conclusion
The Prototype Pollution vulnerability in @hapi/subtext can have serious implications for the security and integrity of Node.js applications that use this package. It is crucial to upgrade to the recommended versions to ensure the mitigation of this vulnerability. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for @hapi/subtext →
FAQ
Prototype Pollution is a vulnerability that occurs when an attacker can modify the prototype of an object, allowing them to control or manipulate its behavior.
The Prototype Pollution vulnerability in @hapi/subtext can lead to unauthorized access to data, bypassing of validation rules, and potential denial-of-service attacks if unhandled exceptions occur.
No, only versions prior to 6.1.3 or 7.0.3 are vulnerable to this Prototype Pollution issue.
You can use the Vulert Playground at Vulert Scanner to check if your application is affected by this vulnerability. Simply provide your package-lock.json file for analysis.
No, upgrading to the fixed versions is the recommended solution to address this vulnerability.
References
Related vulnerabilities
Recent vulnerabilities recorded for @hapi/subtext.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
