Find, fix and prevent vulnerabilities in your code.

Overview

Affected versions of this package are vulnerable to Prototype Pollution in the deepRef function of lib/compiler.js, which traverses through a scalar value into the prototype chain, and whose containment guard is missed because currentPath inconsistently holds arrays that coerce to comma-separated strings ("a,b") while the guard checks dot-separated paths ("a.b"). An attacker can inject arbitrary properties onto Object.prototype, affecting every object in the process, by supplying a TOML document whose table path steps through a scalar into __proto__.__proto__, for example [a.b.y.__proto__.__proto__] after y = 1. This requires the application to parse attacker-controlled TOML.

Details

Prototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as __proto__, constructor and prototype. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the Object.prototype are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.

There are two main ways in which the pollution of prototypes occurs:

• Unsafe Object recursive merge

• Property definition by path

Unsafe Object recursive merge

The logic of a vulnerable recursive merge function follows the following high-level model:

merge (target, source)

  foreach property of source

    if property exists and is an object on both the target and the source

      merge(target[property], source[property])

    else

      target[property] = source[property]

When the source object contains a property named __proto__ defined with Object.defineProperty() , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of Object and the source of Object as defined by the attacker. Properties are then copied on the Object prototype.

Clone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: merge({},source).

lodash and Hoek are examples of libraries susceptible to recursive merge attacks.

Property definition by path

There are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: theFunction(object, path, value)

If the attacker can control the value of “path”, they can set this value to __proto__.myValue. myValue is then assigned to the prototype of the class of the object.

Types of attacks

There are a few methods by which Prototype Pollution can be manipulated:

Affected environments

The following environments are susceptible to a Prototype Pollution attack:

• Application server

• Web server

• Web browser

How to prevent

1. Freeze the prototype— use Object.freeze (Object.prototype).

2. Require schema validation of JSON input.

3. Avoid using unsafe recursive merge functions.

4. Consider using objects without prototypes (for example, Object.create(null)), breaking the prototype chain and preventing pollution.

5. As a best practice use Map instead of Object.

For more information on this vulnerability type:

Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018

Remediation

Upgrade toml to version 4.1.2 or higher.

References

• GitHub Advisory
• GitHub Commit
• GitHub Commit

Overview

Affected versions of this package are vulnerable to Missing Release of Memory after Effective Lifetime via improper cleanup of the zlib compression stream when a client disconnects before the response finishes. The onResponseClose handler was absent, leaving native zlib handles unreleased whenever a connection closed mid-response. An attacker can exhaust server memory or file-descriptor resources by repeatedly opening connections and disconnecting before response completion, causing a denial of service.

Remediation

Upgrade compression to version 1.8.2 or higher.

References

• GitHub Commit
• Maintainer's Advisory

Overview

deepmerge-ts is a Deeply merge 2 or more objects respecting type information.

Affected versions of this package are vulnerable to Uncontrolled Recursion via the deepmerge and deepmergeInto functions. An attacker can cause a process crash or denial of service by supplying crafted recursive object graphs that trigger unbounded recursion and stack exhaustion.

Remediation

Upgrade deepmerge-ts to version 8.0.0 or higher.

References

• GitHub Advisory
• GitHub Commit
• GitHub Release

Overview

hono is an Ultrafast web framework for the Edges

Affected versions of this package are vulnerable to Directory Traversal in the toSSG() static site generation function, whose path normalization does not fully collapse runs of consecutive .. segments and treats output directories that differ only in how they are rooted as equivalent. An attacker can cause build output to be written outside the intended output directory by supplying a route parameter with enough .. sequences that reaches ssgParams from an untrusted source.

Note: This affects build-time static site generation only, not request-time routing, and requires the application to build pages from ssgParams values sourced from untrusted origins such as a CMS, API, or user submissions.

Note: This is a bypass of the fix for the vulnerability described in CVE-2026-39408.

Details

A Directory Traversal attack (also known as path traversal) aims to access files and directories that are stored outside the intended folder. By manipulating files with "dot-dot-slash (../)" sequences and its variations, or by using absolute file paths, it may be possible to access arbitrary files and directories stored on file system, including application source code, configuration, and other critical system files.

Directory Traversal vulnerabilities can be generally divided into two types:

• Information Disclosure: Allows the attacker to gain information about the folder structure or read the contents of sensitive files on the system.

st is a module for serving static files on web pages, and contains a vulnerability of this type. In our example, we will serve files from the public route.

If an attacker requests the following URL from our server, it will in turn leak the sensitive private key of the root user.

curl http://localhost:8080/public/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/root/.ssh/id_rsa

Note %2e is the URL encoded version of . (dot).

• Writing arbitrary files: Allows the attacker to create or replace existing files. This type of vulnerability is also known as Zip-Slip.

One way to achieve this is by using a malicious zip archive that holds path traversal filenames. When each filename in the zip archive gets concatenated to the target extraction folder, without validation, the final path ends up outside of the target folder. If an executable or a configuration file is overwritten with a file containing malicious code, the problem can turn into an arbitrary code execution issue quite easily.

The following is an example of a zip archive with one benign file and one malicious file. Extracting the malicious file will result in traversing out of the target folder, ending up in /root/.ssh/ overwriting the authorized_keys file:

2018-04-15 22:04:29 .....           19           19  good.txt
2018-04-15 22:04:42 .....           20           20  ../../../../../../root/.ssh/authorized_keys

Remediation

Upgrade hono to version 4.13.5 or higher.

References

• GitHub Advisory
• GitHub Commit
• GitHub Release

Overview

Affected versions of this package are vulnerable to Uncontrolled Recursion in lib/parser.js, where the mutually recursive peg$parsevalue(), peg$parsearray(), and peg$parseinline_table_entry() functions recurse to the input's nesting depth with no depth limit. An attacker can crash the process with a RangeError: Maximum call stack size exceeded by supplying a deeply nested TOML document, such as a ~6 KB payload nested about 2,500 levels (a=[[[...]]]). This requires the application to call toml.parse() on untrusted input, and error handlers that catch only SyntaxError do not contain the resulting RangeError, which is not a SyntaxError subclass.

Remediation

Upgrade toml to version 4.2.0 or higher.

References

• GitHub Advisory
• GitHub Commit
• GitHub PR

Overview

hono is an Ultrafast web framework for the Edges

Affected versions of this package are vulnerable to HTTP Request Smuggling in its query parsing helpers, which do not terminate at the URL fragment and parse a ? appearing after a # as the start of the query string. An attacker can smuggle parameters past upstream allow/deny lists and validation, poison cache entries with unobserved parameters, or achieve stored XSS in cached HTML, by placing query parameters after a # fragment so browsers, new URL(), and reverse proxies ignore them while the query helpers still read them. This requires a literal # in the request URL to reach the application, and deployments behind intermediaries that strip fragments or runtimes that normalize URLs, such as Cloudflare Workers, are unaffected.

Remediation

Upgrade hono to version 4.13.5 or higher.

References

• GitHub Advisory
• GitHub Commit
• GitHub Release

Overview

@hono/node-server is a Node.js Adapter for Hono

Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via the upgradeWebSocket. An attacker can cause unbounded memory consumption by sending repeated WebSocket upgrade requests with missing or malformed Sec-WebSocket-Key headers, resulting in permanent retention of request objects and eventual exhaustion of system memory.

Remediation

Upgrade @hono/node-server to version 2.0.10 or higher.

References

• GitHub Advisory
• GitHub Commit
• GitHub Release