EIQ-2019-0008

EIQ-2019-0008

CVE-2018-3728

hoek enables prototype pollution

05 Feb 2019

2 - MEDIUM

6.5

2.5.0

The hoek Node.js module versions 4.2.0 and earlier, and from version 5.0.0 to 5.0.2, make it possible for an attacker to use the merge, applyToDefaults, and applyToDefaultsWithShallow functions to pass a non-validated JSON string containing the __proto__ accessor property.
This enables arbitrary adding or modifying object prototype properties.

Modified properties are propagated through inheritance to all objects, which can result in a denial of service attack.

Update to hoek 4.2.1, or 6.0.0 or later.

2.1.0 to 2.4.0 included.

For more information, see:

• Prototype pollution

• Prototype pollution attack (Hoek)

• Prototype pollution affecting hoek package versions <4.2.1 || >=5.0.0 <5.0.3

• prototype pollution issues in npm audit log