CVE-2018-3728 Prototype Pollution in hoek
HighCVSS 8.8
EPSS 4.2%
- Published
- Updated
- Exploit status
- No public exploit known
Description
hoek node module before 4.2.0 and 5.0.x before 5.0.3 suffers from a Modification of Assumed-Immutable Data (MAID) vulnerability via 'merge' and 'applyToDefaults' functions, which allows a malicious user to modify the prototype of "Object" via proto, causing the addition or modification of an existing property that will exist on all objects.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/node-hoek(Debian:12) | < 5.0.3-1 | 5.0.3-1 |
| debian/node-hoek(Debian:13) | < 5.0.3-1 | 5.0.3-1 |
| debian/node-hoek(Debian:14) | < 5.0.3-1 | 5.0.3-1 |
| npm hoek(npm) | >= 5.0.0, < 5.0.3 | 5.0.3 |
| npm hoek(npm) | < 4.2.1 | 4.2.1 |
| hapijs hoek | < 4.2.0 | 4.2.0 |
| hapijs hoek | >= 5.0.0, < 5.0.3 | 5.0.3 |
| ubuntu/node-hoek(Ubuntu:24.04) | All versions | No fix listed |
| ubuntu/node-hoek(Ubuntu:26.04) | All versions | No fix listed |
| ubuntu/node-hoek(Ubuntu:26.10) | All versions | No fix listed |
| hapi hoek node module | = Versions before 5.0.3 | No fix listed |
| ubuntu/node-hoek(Ubuntu:22.04) | All versions | No fix listed |
References
- Ubuntu CVE tracker vendor-advisory
- www.cve.org
- Debian Security Tracker CVE-2018-3728 vendor-advisory
- nvd.nist.gov third-party-advisory
- hackerone.com exploit third-party-advisory
- github.com patch third-party-advisory
- RHSA-2018:1263 third-party-advisory vendor-advisory
- RHSA-2018:1264 third-party-advisory vendor-advisory
- snyk.io exploit patch third-party-advisory
- github.com patch
- web.archive.org
- github.com
- 103108 third-party-advisory vdb-entry
- nodesecurity.io broken-link