Prototype pollution in dotty

Description

Prototype pollution vulnerability in ‘dotty’ before version 0.1.1 allows attackers to cause a denial of service and may lead to remote code execution.

Recommendation

Update the dotty package to the latest compatible version. Followings are version details:

• Affected version(s): < 0.1.1
• Patched version(s): 0.1.1

References

• GHSA-f5c9-x9j6-87qp
• www.npmjs.com
• www.whitesourcesoftware.com
• CVE-2021-25912
• CWE-400
• CAPEC-310
• OWASP 2021-A6

Related Issues

• Prototype Pollution in dotty - dotty - CVE-2021-23624
• Prototype Pollution in async - CVE-2021-43138
• Prototype Pollution in cookiex/deep - CVE-2021-23442
• Prototype Pollution in js-data - js-data - CVE-2021-23574

You might also like:

How to Secure your NodeJs Express Javascript Application - part 1

How to Secure your NodeJs Express Javascript Application - part 2

10 Secure Coding Best Practices to Follow in Every Project

Tags:

npm

dotty