Prototype Pollution in copy-props

Description

The package copy-props before 2.0.5 are vulnerable to Prototype Pollution via the main functionality.

Recommendation

Update the copy-props package to the latest compatible version. Followings are version details:

• Affected version(s): < 2.0.5
• Patched version(s): 2.0.5

References

• GHSA-897m-rjf5-jp39
• snyk.io
• CVE-2020-28503
• CWE-1321
• CAPEC-310
• OWASP 2021-A6

Related Issues

• Prototype pollution in controlled-merge - CVE-2020-28268
• Prototype Pollution in gedi - CVE-2020-7727
• Prototype Pollution in tiny-conf - CVE-2020-7724
• Prototype Pollution in promisehelpers - CVE-2020-7723

You might also like:

How to Secure your NodeJs Express Javascript Application - part 1

How to Secure your NodeJs Express Javascript Application - part 2

10 Secure Coding Best Practices to Follow in Every Project

Tags:

npm

copy-props