deep-object-diff vulnerable to Prototype Pollution

Description

deep-object-diff before version 1.1.6 allows an external attacker to edit or add new properties to an object. This is possible because the application does not properly validate incoming JSON keys, thus allowing the __proto__ property to be edited. This issue was fixed in version 1.1.9.

Recommendation

Update the deep-object-diff package to the latest compatible version. Followings are version details:

• Affected version(s): >= 1.1.6, < 1.1.9
• Patched version(s): 1.1.9

References

• GHSA-653v-rqx9-j85p
• fluidattacks.com
• CVE-2022-41713
• CWE-1321
• CAPEC-310
• OWASP 2021-A6

Related Issues

• deep-parse-json vulnerable to Prototype Pollution - CVE-2022-42743
• steal vulnerable to Prototype Pollution - CVE-2022-37258
• Deep Merge is Vulnerable to Prototype Pollution Through Lack of Sanitization - CVE-2026-6594
• steal vulnerable to Prototype Pollution via alias variable - CVE-2022-37265

You might also like:

How to Secure your NodeJs Express Javascript Application - part 1

How to Secure your NodeJs Express Javascript Application - part 2

10 Secure Coding Best Practices to Follow in Every Project

Tags:

npm

deep-object-diff