Prototype Pollution in hoek

Also known as GHSA-jp4x-w63m-7wgm

Published 8 y ago 2018-03-30 · modified 4 mo ago 2026-06-17 · JSON

CVSS

8.8

v3.0 · NVD

CISA KEV

not known exploited

EPSS

4.2%

percentile 91%

Public exploits

none known

hoek node module before 4.2.0 and 5.0.x before 5.0.3 suffers from a Modification of Assumed-Immutable Data (MAID) vulnerability via 'merge' and 'applyToDefaults' functions, which allows a malicious user to modify the prototype of "Object" via __proto__, causing the addition or modification of an existing property that will exist on all objects.

Exploit prediction (EPSS)

4.19% probability of exploitation in the next 30 days, higher than 91% of all scored CVEs.

CVSS scores

Assigned by	Version	Score	Vector
NVD	3.0	8.8	`CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H`
NVD	2.0	6.5	`AV:N/AC:L/Au:S/C:P/I:P/A:P`
GitHub	3.0	8.8	`CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H`

Affected packages

Ecosystem	Package	Affected	Fixed in
npm	`hoek`	>=5.0.0, <5.0.3 <4.2.1	5.0.3 4.2.1

Affected products

hapi hoek node module

Classification

Weakness

CWE-471 Modification of Assumed-Immutable Data (MAID)
CWE-1321 Improperly Controlled Modification of Object Prototype Attributes

References

github.com /hapijs/hoek/commit/32ed5c9413321fbc37da5ca81a7cbab693786dee · x_refsource_CONFIRM, x_transferred
hackerone.com /reports/310439 · x_refsource_MISC, x_transferred
securityfocus.com /bid/103108 · vdb-entry, x_refsource_BID, x_transferred
access.redhat.com /errata/RHSA-2018:1264 · vendor-advisory, x_refsource_REDHAT, x_transferred
access.redhat.com /errata/RHSA-2018:1263 · vendor-advisory, x_refsource_REDHAT, x_transferred
snyk.io /vuln/npm:hoek:20180212 · x_refsource_MISC, x_transferred
nodesecurity.io /advisories/566 · x_refsource_CONFIRM, x_transferred
nvd.nist.gov /vuln/detail/CVE-2018-3728 · advisory
github.com /hapijs/hoek/commit/5aed1a8c4a3d55722d1c799f2368857bf418d6df · web
github.com /hapijs/hoek · package
web.archive.org /web/20200227131737/https://www.securityfocus.com/bid/103108 · web

Sources

CVE List: CVE-2018-3728
GitHub Advisory: GHSA-jp4x-w63m-7wgm
NVD: CVE-2018-3728

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.

Summary