Fluid Attacks Database

Description

hoek subject to prototype pollution via the clone function. hoek versions prior to 8.5.1, and 9.x prior to 9.0.3 are vulnerable to prototype pollution in the clone function. If an object with the proto key is passed to clone() the key is converted to a prototype. This issue has been patched in version 9.0.3, and backported to 8.5.1.

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem	Component	Affected version	Patched versions
debian 12	node-hoek	>=0 <9.0.3+~5.0.0+~4.0.0-1	9.0.3+~5.0.0+~4.0.0-1
debian 13	node-hoek	>=0 <9.0.3+~5.0.0+~4.0.0-1	9.0.3+~5.0.0+~4.0.0-1
npm	hoek	>=0 <=6.1.3	-
npm	@hapi/hoek	>=0 <8.5.1 \|\| >=9.0.0 <9.0.3	8.5.1, 9.0.3
debian 11	node-hoek	>=0 <9.0.3+~5.0.0+~4.0.0-1	9.0.3+~5.0.0+~4.0.0-1
debian 14	node-hoek	>=0 <9.0.3+~5.0.0+~4.0.0-1	9.0.3+~5.0.0+~4.0.0-1

Aliases

1. CVE-2020-366042. NVD-2020-366043. OSV-DEBIAN-2020-366044. OSV-2020-366045. GCVE-2020-366046. SECURITY-TRACKER-CVE-2020-36604

References

1. https://github.com/hapijs/hoek/issues/3522. https://github.com/hapijs/hoek/commit/4d0804bc6135ad72afdc5e1ec002b935b2f5216a3. https://github.com/hapijs/hoek/commit/948baf98634a5c206875b67d11368f133034fa90

Does your application use this vulnerable software?

During the free trial, our tools assess your application, identify vulnerabilities, and provide recommendations for their remediation.