Prototype Pollution in libnested

Description

The package libnested before 1.5.2 are vulnerable to Prototype Pollution via the set function in index.js. Note: This vulnerability derives from an incomplete fix for CVE-2020-28283

Recommendation

Update the libnested package to the latest compatible version. Followings are version details:

• Affected version(s): < 1.5.2
• Patched version(s): 1.5.2

References

• GHSA-x5m8-2r8v-8f97
• snyk.io
• CVE-2022-25352
• CWE-1321
• CAPEC-310
• OWASP 2021-A6

Related Issues

• steal vulnerable to Prototype Pollution - CVE-2022-37258
• Prototype Pollution in fullpage.js - CVE-2022-1295
• Prototype Pollution in set-in - CVE-2022-25354
• Prototype Pollution in dset - CVE-2022-25645

You might also like:

How to Secure your NodeJs Express Javascript Application - part 1

How to Secure your NodeJs Express Javascript Application - part 2

10 Secure Coding Best Practices to Follow in Every Project

Tags:

npm

libnested