HIGH8.1
GHSA-c429-5p7v-vgjp
hoek subject to prototype pollution via the clone function.
Quick fix
GHSA-c429-5p7v-vgjp — @hapi/hoek: upgrade to the fixed version with the command below.
npm install @hapi/hoek@8.5.1Details
hoek versions prior to 8.5.1, and 9.x prior to 9.0.3 are vulnerable to prototype pollution in the clone function. If an object with the __proto__ key is passed to clone() the key is converted to a prototype. This issue has been patched in version 9.0.3, and backported to 8.5.1.
Are you affected?
Enter the version of the package you're using.
Affected packages
npm/hoek
Introduced in:
0No fixed version published yet for hoek (npm). Pin to a known-safe version or switch to an alternative.