Prototype Pollution in deep-override

Description

Prototype pollution vulnerability in ‘deep-override’ versions 1.0.0 through 1.0.1 allows an attacker to cause a denial of service and may lead to remote code execution.

Recommendation

Update the deep-override package to the latest compatible version. Followings are version details:

• Affected version(s): >= 1.0.0, < 1.0.2
• Patched version(s): 1.0.2

References

• GHSA-v659-54cx-g4qr
• www.whitesourcesoftware.com
• CVE-2021-25941
• CWE-1321
• CAPEC-310
• OWASP 2021-A6

Related Issues

• Prototype Pollution in cookiex/deep - CVE-2021-23442
• deep-defaults vulnerable to prototype pollution - CVE-2021-25944
• set-deep-prop Prototype Pollution - CVE-2021-23373
• Prototype Pollution in record-like-deep-assign - CVE-2021-23402

You might also like:

How to Secure your NodeJs Express Javascript Application - part 1

How to Secure your NodeJs Express Javascript Application - part 2

10 Secure Coding Best Practices to Follow in Every Project

Tags:

npm

deep-override