GitHub Advisoryadvisory · npm

GHSA-c429-5p7v-vgjp hoek subject to prototype pollution via the clone function.

HIGH Published 2022-09-25 Modified 2025-05-28 Official page ↗
Aliases
CVE-2020-36604
Ecosystem
npm
Packages
@hapi/hoek, hoek
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-1321
Reviewed
2022-09-29

Affected packages

• npm @hapi/hoek: < 8.5.1 → fixed in 8.5.1 • npm @hapi/hoek: >= 9.0.0, < 9.0.3 → fixed in 9.0.3 • npm hoek: <= 6.1.3 (no fix yet)

Description

hoek versions prior to 8.5.1, and 9.x prior to 9.0.3 are vulnerable to prototype pollution in the clone function. If an object with the __proto__ key is passed to clone() the key is converted to a prototype. This issue has been patched in version 9.0.3, and backported to 8.5.1.

Related

Alias · CVE (1)

  • CVE-2020-36604 hoek before 8.5.1 and 9.x before 9.0.3 allows prototype poisoning in the clone function. vulnerability

Weakness · CWE (1)

  • CWE-1321 Improperly Controlled Modification of Object Prototype Attributes weakness

References