GHSA-jp4x-w63m-7wgm

Versions of `hoek` prior to 4.2.1 and 5.0.3 are vulnerable to prototype pollution.

The `merge` function, and the `applyToDefaults` and `applyToDefaultsWithShallow` functions which leverage `merge` behind the scenes, are vulnerable to a prototype pollution attack when provided an _unvalidated_ payload created from a JSON string containing the `__proto__` property.

This can be demonstrated like so:

```javascript var Hoek = require('hoek'); var malicious_payload = '{"__proto__":{"oops":"It works !"}}';

var a = {}; console.log("Before : " + a.oops); Hoek.merge({}, JSON.parse(malicious_payload)); console.log("After : " + a.oops); ```

This type of attack can be used to overwrite existing properties causing a potential denial of service.

## Recommendation

Update to version 4.2.1, 5.0.3 or later.