CVE-2020-36604: High severity Hapijs Hoek Node.js vulnerability
hoek before 8.5.1 and 9.x before 9.0.3 allows prototype poisoning in the clone function.
Other sources
hoek versions prior to 8.5.1, and 9.x prior to 9.0.3 are vulnerable to prototype pollution in the clone function. If an object with the proto key is passed to clone() the key is converted to a prototype. This issue has been patched in version 9.0.3, and backported to 8.5.1.
— GitHub
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
npm/@hapi/hoekto a version that resolves this vulnerability.Fixed in 9.0.3 - Upgrade
Upgrade
npm/@hapi/hoekto a version that resolves this vulnerability.Fixed in 8.5.1 - Upgrade
Upgrade
hoekto a version that resolves this vulnerability.Fixed in 8.5.1 - Upgrade
Upgrade
hoekto a version that resolves this vulnerability.Fixed in 9.0.3
Event History
Frequently Asked Questions
What is the severity of CVE-2020-36604?
CVE-2020-36604 is categorized as a high severity vulnerability due to its potential for prototype pollution.
How do I fix CVE-2020-36604?
To fix CVE-2020-36604, update to hoek version 8.5.1 or 9.0.3 or later.
What software is affected by CVE-2020-36604?
CVE-2020-36604 affects hoek versions prior to 8.5.1 and 9.x prior to 9.0.3.
What type of vulnerability is CVE-2020-36604?
CVE-2020-36604 is a prototype pollution vulnerability that can lead to security risks when using the clone function.
What is the impact of CVE-2020-36604?
The impact of CVE-2020-36604 includes the potential for attackers to manipulate an object's prototype, leading to unexpected behavior in applications.