Advisory Database
  • Advisories
  • Dependency Scanning
  1. npm
  2. ›
  3. hoek
  4. ›
  5. CVE-2018-3728

CVE-2018-3728: Prototype Pollution in hoek

April 26, 2018 (updated May 29, 2025)

Versions of hoek prior to 4.2.1 and 5.0.3 are vulnerable to prototype pollution.

The merge function, and the applyToDefaults and applyToDefaultsWithShallow functions which leverage merge behind the scenes, are vulnerable to a prototype pollution attack when provided an unvalidated payload created from a JSON string containing the __proto__ property.

This can be demonstrated like so:

var Hoek = require('hoek');
var malicious_payload = '{"__proto__":{"oops":"It works !"}}';

var a = {};
console.log("Before : " + a.oops);
Hoek.merge({}, JSON.parse(malicious_payload));
console.log("After : " + a.oops);

This type of attack can be used to overwrite existing properties causing a potential denial of service.

References

  • access.redhat.com/errata/RHSA-2018:1263
  • access.redhat.com/errata/RHSA-2018:1264
  • github.com/advisories/GHSA-jp4x-w63m-7wgm
  • github.com/hapijs/hoek
  • github.com/hapijs/hoek/commit/32ed5c9413321fbc37da5ca81a7cbab693786dee
  • github.com/hapijs/hoek/commit/5aed1a8c4a3d55722d1c799f2368857bf418d6df
  • hackerone.com/reports/310439
  • nvd.nist.gov/vuln/detail/CVE-2018-3728
  • snyk.io/vuln/npm:hoek:20180212
  • web.archive.org/web/20200227131737/https://www.securityfocus.com/bid/103108

Code Behaviors & Features

Detect and mitigate CVE-2018-3728 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →

Affected versions

All versions before 4.2.1, all versions starting from 5.0.0 before 5.0.3

Fixed versions

  • 5.0.3
  • 4.2.1

Solution

Upgrade to versions 4.2.1, 5.0.3 or above.

Impact 8.8 HIGH

CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Learn more about CVSS

Weakness

  • CWE-1321: Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')

Source file

npm/hoek/CVE-2018-3728.yml

Spotted a mistake? Edit the file on GitLab.

  • Site Repo
  • About GitLab
  • Terms
  • Privacy Statement
  • Contact

Page generated Wed, 20 Aug 2025 00:19:30 +0000.