Snyk test report

Uncaught Exception

---

Overview

node is a JavaScript runtime built on Chrome's V8 JavaScript engine.

Affected versions of this package are vulnerable to Uncaught Exception in the TLS module when a SNICallback throws synchronously on unexpected input the exception bypasses TLS error handlers and propagates as an uncaught exception. A remote attacker can crash or exhaust resources of a TLS server by sending input that causes the callback to throw an error.

Note:

This is caused by an incomplete fix for CVE-2026-21637.

Remediation

Upgrade node to version 20.20.2, 22.22.2, 24.14.1, 25.8.2 or higher.

References

• GitHub Commit
• Node.js Security Releases

---

Uncaught Exception

---

Overview

node is a JavaScript runtime built on Chrome's V8 JavaScript engine.

Affected versions of this package are vulnerable to Uncaught Exception in Node.js HTTP request handling. The flaw triggers when an incoming request includes a header named __proto__ and the server application accesses req.headersDistinct. This causes dest["__proto__"] to incorrectly resolve to Object.prototype, resulting in an uncaught TypeError when .push() is called on a non-array. Because this exception is thrown synchronously inside a property getter, standard error listeners cannot intercept it. This causes the Node.js process to crash unless every access is explicitly wrapped in a try/catch block.

Remediation

Upgrade node to version 20.20.2, 22.22.2, 24.14.1, 25.8.2 or higher.

References

• GitHub Commit
• Node.js Security Releases

---

Integer Overflow or Wraparound

---

Overview

node is a JavaScript runtime built on Chrome's V8 JavaScript engine.

Affected versions of this package are vulnerable to Integer Overflow or Wraparound in the WebCrypto cipher output length calculation in src/crypto/crypto_aes.cc, where data_len + blockSize + tag_len is computed as a signed int before being passed to OpenSSL. An attacker can abort the process and cause a denial of service by passing an input around a multiple of 2 GiB to subtle.encrypt(), which overflows that length computation and crashes the runtime.

Remediation

Upgrade node to version 22.23.0, 24.17.0, 26.3.1 or higher.

References

• GitHub Commit
• Node.js Advisory

---

Improper Certificate Validation

---

Overview

node is a JavaScript runtime built on Chrome's V8 JavaScript engine.

Affected versions of this package are vulnerable to Improper Certificate Validation due to the HTTPS Agent skipping hostname verification across identity policies. An attacker can intercept or manipulate encrypted communications by exploiting TLS session reuse without proper hostname validation.

Remediation

Upgrade node to version 22.23.2, 24.18.1, 26.5.1 or higher.

References

• GitHub Commit
• GitHub Commit
• GitHub Commit
• Node.js

---

Directory Traversal

---

Overview

node is a JavaScript runtime built on Chrome's V8 JavaScript engine.

Affected versions of this package are vulnerable to Directory Traversal due to improper enforcement of the permission model in the process.report. An attacker can access or overwrite files outside of the intended --allow-fs-write paths by leveraging this flaw to bypass security boundaries.

Details

A Directory Traversal attack (also known as path traversal) aims to access files and directories that are stored outside the intended folder. By manipulating files with "dot-dot-slash (../)" sequences and its variations, or by using absolute file paths, it may be possible to access arbitrary files and directories stored on file system, including application source code, configuration, and other critical system files.

Directory Traversal vulnerabilities can be generally divided into two types:

• Information Disclosure: Allows the attacker to gain information about the folder structure or read the contents of sensitive files on the system.

st is a module for serving static files on web pages, and contains a vulnerability of this type. In our example, we will serve files from the public route.

If an attacker requests the following URL from our server, it will in turn leak the sensitive private key of the root user.

curl http://localhost:8080/public/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/root/.ssh/id_rsa
        

Note %2e is the URL encoded version of . (dot).

• Writing arbitrary files: Allows the attacker to create or replace existing files. This type of vulnerability is also known as Zip-Slip.

One way to achieve this is by using a malicious zip archive that holds path traversal filenames. When each filename in the zip archive gets concatenated to the target extraction folder, without validation, the final path ends up outside of the target folder. If an executable or a configuration file is overwritten with a file containing malicious code, the problem can turn into an arbitrary code execution issue quite easily.

The following is an example of a zip archive with one benign file and one malicious file. Extracting the malicious file will result in traversing out of the target folder, ending up in /root/.ssh/ overwriting the authorized_keys file:

2018-04-15 22:04:29 .....           19           19  good.txt
        2018-04-15 22:04:42 .....           20           20  ../../../../../../root/.ssh/authorized_keys
        

Remediation

Upgrade node to version 22.23.2, 24.18.1, 26.5.1 or higher.

References

• GitHub Commit
• GitHub Commit
• GitHub Commit
• Node.js

---

Allocation of Resources Without Limits or Throttling

---

Overview

node is a JavaScript runtime built on Chrome's V8 JavaScript engine.

Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via the HTTP/2 header block handling. An attacker can cause excessive memory consumption by sending specially crafted HTTP/2 requests that bypass memory limits.

Remediation

Upgrade node to version 22.23.2, 24.18.1 or higher.

References

• GitHub Commit
• GitHub Commit
• Node.js

---

Use After Free

---

Overview

node is a JavaScript runtime built on Chrome's V8 JavaScript engine.

Affected versions of this package are vulnerable to Use After Free in the HTTP/2 handling process when nghttp2_session_mem_send() is called re-entrantly during the execution of nghttp2_session_mem_recv(). An attacker can cause a heap-use-after-free condition by triggering concurrent or re-entrant calls, potentially leading to denial of service or other unpredictable behavior.

Remediation

Upgrade node to version 22.23.2, 24.18.1, 26.5.1 or higher.

References

• GitHub Commit
• Node.js

---

Allocation of Resources Without Limits or Throttling

---

Overview

node is a JavaScript runtime built on Chrome's V8 JavaScript engine.

Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the dns.resolveAny function when processing a DNS response containing more than 256 A records. An attacker can cause the process to abort repeatedly by sending specially crafted DNS responses.

Remediation

Upgrade node to version 22.23.2, 24.18.1, 26.5.1 or higher.

References

• GitHub Commit
• GitHub Commit
• GitHub Commit
• Node.js

---

Allocation of Resources Without Limits or Throttling

---

Overview

node is a JavaScript runtime built on Chrome's V8 JavaScript engine.

Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via the node:zlib synchronous APIs when a spoofed TypedArray byteLength triggers a reachable assertion. An attacker can cause the process to crash repeatedly by exploiting this condition.

Remediation

Upgrade node to version 22.23.2, 24.18.1, 26.5.1 or higher.

References

• GitHub Commit
• GitHub Commit
• GitHub Commit
• Node.js

---

Directory Traversal

---

Overview

moment is a lightweight JavaScript date library for parsing, validating, manipulating, and formatting dates.

Affected versions of this package are vulnerable to Directory Traversal in the locale() function, whose locale name validation is circumvented by a non-string value, so an object can direct the load to an attacker-specified path. An attacker can cause a file to be loaded from a path of their choosing by supplying a non-string value that the application passes to moment.locale(). This requires the application to hand user-supplied non-string input directly to moment.locale(), plain strings are unaffected because the existing validation rejects those containing path separators, and only server-side npm consumers are in scope.

Note: This is a bypass of the fix for the vulnerability described in CVE-2022-24785.

Details

A Directory Traversal attack (also known as path traversal) aims to access files and directories that are stored outside the intended folder. By manipulating files with "dot-dot-slash (../)" sequences and its variations, or by using absolute file paths, it may be possible to access arbitrary files and directories stored on file system, including application source code, configuration, and other critical system files.

Directory Traversal vulnerabilities can be generally divided into two types:

• Information Disclosure: Allows the attacker to gain information about the folder structure or read the contents of sensitive files on the system.

st is a module for serving static files on web pages, and contains a vulnerability of this type. In our example, we will serve files from the public route.

If an attacker requests the following URL from our server, it will in turn leak the sensitive private key of the root user.

curl http://localhost:8080/public/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/root/.ssh/id_rsa
        

Note %2e is the URL encoded version of . (dot).

• Writing arbitrary files: Allows the attacker to create or replace existing files. This type of vulnerability is also known as Zip-Slip.

One way to achieve this is by using a malicious zip archive that holds path traversal filenames. When each filename in the zip archive gets concatenated to the target extraction folder, without validation, the final path ends up outside of the target folder. If an executable or a configuration file is overwritten with a file containing malicious code, the problem can turn into an arbitrary code execution issue quite easily.

The following is an example of a zip archive with one benign file and one malicious file. Extracting the malicious file will result in traversing out of the target folder, ending up in /root/.ssh/ overwriting the authorized_keys file:

2018-04-15 22:04:29 .....           19           19  good.txt
        2018-04-15 22:04:42 .....           20           20  ../../../../../../root/.ssh/authorized_keys
        

Remediation

Upgrade moment to version 2.31.0 or higher.

References

• GitHub Advisory
• GitHub Commit

---

Use After Free

---

NVD Description

Note: Versions mentioned in the description apply only to the upstream lua5.1 package and not the lua5.1 package as distributed by Ubuntu. See How to fix? for Ubuntu:22.04 relevant fixed versions and status.

Redis is an open source, in-memory database that persists on disk. Versions 8.2.1 and below allow an authenticated user to use a specially crafted Lua script to manipulate the garbage collector, trigger a use-after-free and potentially lead to remote code execution. The problem exists in all versions of Redis with Lua scripting. This issue is fixed in version 8.2.2. To workaround this issue without patching the redis-server executable is to prevent users from executing Lua scripts. This can be done using ACL to restrict EVAL and EVALSHA commands.

Remediation

Upgrade Ubuntu:22.04 lua5.1 to version 5.1.5-8.1ubuntu0.22.04.1~esm1 or higher.

References

• http://people.ubuntu.com/~ubuntu-security/cve/CVE-2025-49844
• https://github.com/redis/redis/commit/d5728cb5795c966c5b5b1e0f0ac576a7e69af539
• https://github.com/redis/redis/releases/tag/8.2.2
• https://github.com/redis/redis/security/advisories/GHSA-4789-qfc9-5f9q
• http://www.openwall.com/lists/oss-security/2025/10/07/2
• https://github.com/lastvocher/redis-CVE-2025-49844
• https://github.com/projectdiscovery/nuclei-templates/blob/main/javascript/cves/2025/CVE-2025-49844.yaml

---

Stack-based Buffer Overflow

---

NVD Description

Note: Versions mentioned in the description apply only to the upstream lua-bitop package and not the lua-bitop package as distributed by Ubuntu. See How to fix? for Ubuntu:22.04 relevant fixed versions and status.

Redis is an open source, in-memory database that persists on disk. An authenticated user may use a specially crafted Lua script to trigger a stack buffer overflow in the bit library, which may potentially lead to remote code execution. The problem exists in all versions of Redis with Lua scripting. This problem has been fixed in Redis versions 6.2.16, 7.2.6, and 7.4.1. Users are advised to upgrade. There are no known workarounds for this vulnerability.

Remediation

Upgrade Ubuntu:22.04 lua-bitop to version 1.0.2-5ubuntu0.22.04.1~esm2 or higher.

References

• http://people.ubuntu.com/~ubuntu-security/cve/CVE-2024-31449
• https://github.com/redis/redis/commit/1f7c148be2cbacf7d50aa461c58b871e87cc5ed9
• https://github.com/redis/redis/security/advisories/GHSA-whxg-wx83-85p5

---

Inefficient Algorithmic Complexity

---

Overview

js-yaml is a human-friendly data serialization language.

Affected versions of this package are vulnerable to Inefficient Algorithmic Complexity in merge key (<<) handling during YAML parsing, where each mapping in a chain re-enumerates the keys inherited from the previous mapping. An attacker can exhaust CPU and cause denial of service by supplying a document with N chained merge mappings, which forces roughly O(N^2) work for O(N) input. Exploitation requires the application to parse untrusted YAML with the default or YAML11 schema, under which merge keys are resolved.

Remediation

Upgrade js-yaml to version 3.15.0, 4.3.0 or higher.

References

• GitHub Advisory
• GitHub Commit
• GitHub Commit
• GitHub Commit

---

Inefficient Algorithmic Complexity

---

Overview

js-yaml is a human-friendly data serialization language.

Affected versions of this package are vulnerable to Inefficient Algorithmic Complexity through the yaml.load process. An attacker can cause excessive CPU consumption and block the event loop by providing a specially crafted YAML document containing a large !!omap sequence.

Remediation

Upgrade js-yaml to version 3.15.1, 4.3.1 or higher.

References

• GitHub Advisory

---

Allocation of Resources Without Limits or Throttling

---

Overview

js-yaml is a human-friendly data serialization language.

Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the merge key (<<) handling of the loader, where the maxTotalMergeKeys budget does not count empty mappings against its limit. An attacker can consume significant CPU, on the order of O(N*K) for N empty mappings merged K times, with a relatively small document by repeatedly merging a large sequence of empty mappings so the budget counter never increments.

Note: This requires YAML merge processing to be enabled for untrusted YAML, which is the default behavior in versions 3 and 4, but is not the default in version 5.

Remediation

Upgrade js-yaml to version 3.15.2, 4.3.2 or higher.

References

• GitHub Advisory
• GitHub Commit
• GitHub Commit
• GitHub Commit
• GitHub PR
• GitHub Release
• GitHub Release

---

Interpretation Conflict

---

Overview

fast-uri is a Dependency-free RFC 3986 URI toolbox

Affected versions of this package are vulnerable to Interpretation Conflict in resolve() through the resolve() process in index.js. An attacker can make an application resolve a scheme-relative reference such as //host/ against a scheme-bearing base and receive a host string that does not match the host produced when the result is parsed again. This lets policy checks or routing decisions operate on one host while the resolved URI actually points at another, which can bypass host allowlists and send the user to an unexpected destination.

Workarounds

• Resolve scheme-relative references against a base URI that already includes a scheme before any host-policy or origin check, so the host is evaluated in its final scheme context and cannot be checked under one interpretation and used under another.

Remediation

Upgrade fast-uri to version 2.4.5, 3.1.6, 4.1.3 or higher.

References

• GitHub Commit v2.4.5
• GitHub Commit v3.1.6
• GitHub Commit v4.1.3
• Maintainer's Advisory

---

Improper Handling of URL Encoding (Hex Encoding)

---

Overview

fast-uri is a Dependency-free RFC 3986 URI toolbox

Affected versions of this package are vulnerable to Improper Handling of URL Encoding (Hex Encoding) through the parseWithStatus, normalizeStringWithStatus, normalizeComparableURI, and resolve paths in index.js. An attacker can steer a URL normalizer or resolver to an attacker-chosen host by supplying a URI whose scheme decodes into reserved delimiter characters, such as %2f%2fevil.example:/pwn, causing normalize() or resolve() to emit a string that reparses with a different authority. This lets untrusted input bypass host-based redirect checks, allowlists, or outbound request decisions when applications trust the normalized result. A scheme containing encoded CRLF can also be serialized back as raw line breaks, which can corrupt a URI placed into a response header.

Remediation

Upgrade fast-uri to version 2.4.5, 3.1.6, 4.1.3 or higher.

References

• GitHub Commit v2.4.5
• GitHub Commit v3.1.6
• GitHub Commit v4.1.3
• Maintainer's Advisory

---

Improper Validation of Syntactic Correctness of Input

---

Overview

fast-uri is a Dependency-free RFC 3986 URI toolbox

Affected versions of this package are vulnerable to Improper Validation of Syntactic Correctness of Input through the normalizeIPv6() and parseWithStatus() host-processing paths in lib/utils.js and index.js. An attacker can route an application to a local or private address by supplying a malformed bracketed IPv6 literal such as http://[::not-valid]/private before the URL is normalized or checked. The parser accepts the malformed host without an error and silently rewrites it into a different valid IPv6 address, so downstream redirect handling, outbound requests, or host allowlist checks operate on the wrong destination. This can send traffic to loopback, unique-local, or link-local targets and expose internal services to unintended requests.

Workarounds

• Reject untrusted URLs whose host is a bracketed IPv6 literal before passing them to fast-uri; this prevents malformed IPv6 text from being normalized into a different valid local or private address.
• Route outbound requests against an explicit allowlist of addresses instead of trusting the normalized host; this limits the impact if a malformed bracketed IPv6 literal is supplied.

Remediation

Upgrade fast-uri to version 2.4.5, 3.1.6, 4.1.3 or higher.

References

• GitHub Commit v2.4.5
• GitHub Commit v3.1.6
• GitHub Commit v4.1.3
• Maintainer's Advisory

---

Double Decoding of the Same Data

---

Overview

fast-uri is a Dependency-free RFC 3986 URI toolbox

Affected versions of this package are vulnerable to Double Decoding of the Same Data through hostname normalization in normalize() and resolve() and the authority recomposition logic in index.js and lib/utils.js. An attacker can redirect an application to an unintended host by supplying a URI whose hostname contains nested percent-encoded bytes, such as an encoded loopback or metadata address. The parser decodes the hostname once during normalization and then decodes it again when rebuilding the authority, so %25 sequences can turn into live host delimiters or dot characters during processing. Applications that normalize or resolve untrusted URIs before SSRF checks, redirect validation, or host allowlisting can be steered to internal destinations like localhost or a cloud metadata endpoint.

Workarounds

• Reject untrusted URIs whose host component contains an encoded percent sign (%25) before passing them to normalize() or resolve(). This prevents nested percent-encoded hostnames from being decoded into live internal destinations such as loopback or metadata addresses.

Remediation

Upgrade fast-uri to version 2.4.5, 3.1.6, 4.1.3 or higher.

References

• GitHub Commit
• GitHub Commit
• GitHub Commit v3.1.6
• Maintainer's Advisory

---

Improper Encoding or Escaping of Output

---

Overview

fast-uri is a Dependency-free RFC 3986 URI toolbox

Affected versions of this package are vulnerable to Improper Encoding or Escaping of Output that enables authority injection in the recomposeAuthority function, which escapes the userinfo and host components but concatenates the port field verbatim, so non-digit characters in the port introduce authority delimiters. An attacker can restructure the URI to redirect requests to a server they control by supplying a port value such as @127.0.0.1:8124, which demotes the legitimate host to userinfo and yields http://trusted.example:@127.0.0.1:8124/app. This requires the application to build URIs from separate components and assign untrusted data directly to the port field of an object passed to serialize(), normalize(), or equal(), and ports obtained via parse() are unaffected because parsing validates digit-only values.

Remediation

Upgrade fast-uri to version 2.4.6, 3.1.7, 4.1.4 or higher.

References

• GitHub Advisory
• GitHub Commit

---

Prototype Pollution

---

Overview

Affected versions of this package are vulnerable to Prototype Pollution via mergeObject(), which fails to validate keys before writing them to target objects. An attacker can supply a malicious source object containing a __proto__ key in a merge operation, injecting attacker-controlled properties into the prototype of the returned object and causing applications to inherit unintended values when accessing properties without own-property checks. We score this differently from NVD: prototype pollution that achieves property injection into Object.prototype with no authentication and no user interaction warrants a High integrity impact, consistent with the supplied CVSS vectors.

Details

Prototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as __proto__, constructor and prototype. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the Object.prototype are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.

There are two main ways in which the pollution of prototypes occurs:

• Unsafe Object recursive merge

• Property definition by path

Unsafe Object recursive merge

The logic of a vulnerable recursive merge function follows the following high-level model:

merge (target, source)
        
          foreach property of source
        
            if property exists and is an object on both the target and the source
        
              merge(target[property], source[property])
        
            else
        
              target[property] = source[property]
        

When the source object contains a property named __proto__ defined with Object.defineProperty() , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of Object and the source of Object as defined by the attacker. Properties are then copied on the Object prototype.

Clone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: merge({},source).

lodash and Hoek are examples of libraries susceptible to recursive merge attacks.

Property definition by path

There are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: theFunction(object, path, value)

If the attacker can control the value of “path”, they can set this value to __proto__.myValue. myValue is then assigned to the prototype of the class of the object.

Types of attacks

There are a few methods by which Prototype Pollution can be manipulated:

Type	Origin	Short description
Denial of service (DoS)	Client	This is the most likely attack. DoS occurs when Object holds generic functions that are implicitly called for various operations (for example, toString and valueOf). The attacker pollutes Object.prototype.someattr and alters its state to an unexpected value such as Int or Object. In this case, the code fails and is likely to cause a denial of service. For example: if an attacker pollutes Object.prototype.toString by defining it as an integer, if the codebase at any point was reliant on someobject.toString() it would fail.
Remote Code Execution	Client	Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation. For example: eval(someobject.someattr). In this case, if the attacker pollutes Object.prototype.someattr they are likely to be able to leverage this in order to execute code.
Property Injection	Client	The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens. For example: if a codebase checks privileges for someuser.isAdmin, then when the attacker pollutes Object.prototype.isAdmin and sets it to equal true, they can then achieve admin privileges.

Affected environments

The following environments are susceptible to a Prototype Pollution attack:

• Application server

• Web server

• Web browser

How to prevent

1. Freeze the prototype— use Object.freeze (Object.prototype).

2. Require schema validation of JSON input.

3. Avoid using unsafe recursive merge functions.

4. Consider using objects without prototypes (for example, Object.create(null)), breaking the prototype chain and preventing pollution.

5. As a best practice use Map instead of Object.

For more information on this vulnerability type:

Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018

Remediation

There is no fixed version for deepmerge.

References

• GitHub Issue
• Vulnerable Code

---

Prototype Pollution

---

Overview

browserslist is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset

Affected versions of this package are vulnerable to Prototype Pollution via the normalizeStats() function in node.js. An attacker can crash the process or alter an object’s prototype by supplying a poisoned browserslist-stats.json file or untrusted stats data with inherited object-key names such as __proto__ or toString. The function iterates untrusted keys and writes them into a plain object without an own-property check, so a crafted stats entry can trigger a TypeError on lookup or invoke the __proto__ setter during assignment, breaking any tool that calls browserslist() and causing a denial of service.

Details

Prototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as __proto__, constructor and prototype. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the Object.prototype are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.

There are two main ways in which the pollution of prototypes occurs:

• Unsafe Object recursive merge

• Property definition by path

Unsafe Object recursive merge

The logic of a vulnerable recursive merge function follows the following high-level model:

merge (target, source)
        
          foreach property of source
        
            if property exists and is an object on both the target and the source
        
              merge(target[property], source[property])
        
            else
        
              target[property] = source[property]
        

When the source object contains a property named __proto__ defined with Object.defineProperty() , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of Object and the source of Object as defined by the attacker. Properties are then copied on the Object prototype.

Clone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: merge({},source).

lodash and Hoek are examples of libraries susceptible to recursive merge attacks.

Property definition by path

There are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: theFunction(object, path, value)

If the attacker can control the value of “path”, they can set this value to __proto__.myValue. myValue is then assigned to the prototype of the class of the object.

Types of attacks

There are a few methods by which Prototype Pollution can be manipulated:

Type	Origin	Short description
Denial of service (DoS)	Client	This is the most likely attack. DoS occurs when Object holds generic functions that are implicitly called for various operations (for example, toString and valueOf). The attacker pollutes Object.prototype.someattr and alters its state to an unexpected value such as Int or Object. In this case, the code fails and is likely to cause a denial of service. For example: if an attacker pollutes Object.prototype.toString by defining it as an integer, if the codebase at any point was reliant on someobject.toString() it would fail.
Remote Code Execution	Client	Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation. For example: eval(someobject.someattr). In this case, if the attacker pollutes Object.prototype.someattr they are likely to be able to leverage this in order to execute code.
Property Injection	Client	The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens. For example: if a codebase checks privileges for someuser.isAdmin, then when the attacker pollutes Object.prototype.isAdmin and sets it to equal true, they can then achieve admin privileges.

Affected environments

The following environments are susceptible to a Prototype Pollution attack:

• Application server

• Web server

• Web browser

How to prevent

1. Freeze the prototype— use Object.freeze (Object.prototype).

2. Require schema validation of JSON input.

3. Avoid using unsafe recursive merge functions.

4. Consider using objects without prototypes (for example, Object.create(null)), breaking the prototype chain and preventing pollution.

5. As a best practice use Map instead of Object.

For more information on this vulnerability type:

Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018

Remediation

Upgrade browserslist to version 4.28.7 or higher.

References

• GitHub Commit
• Maintainer's Advisory

---

Allocation of Resources Without Limits or Throttling

---

Overview

browserslist is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset

Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the in-memory cache and parseCache in index.js. An attacker can eventually exhaust process memory and crash a long-running Node.js application by sending a stream of distinct query strings, causing each unique browserslist() result and parsed query AST to be retained indefinitely.

Remediation

Upgrade browserslist to version 4.28.7 or higher.

References

• GitHub Commit
• Maintainer's Advisory

---