Prototype Pollution in lutils

Description

All versions of package lutils are vulnerable to Prototype Pollution via the main (merge) function.

Recommendation

No fix is available yet. Followings are affected versions:

• <= 2.4.0

References

• GHSA-3r8w-mphv-2f3f
• snyk.io
• CVE-2021-23396
• CWE-1321
• CAPEC-310
• OWASP 2021-A6

Related Issues

• Prototype Pollution in deepmergefn - CVE-2021-23417
• Prototype Pollution in Proto - CVE-2021-23426
• Prototype Pollution in sey - CVE-2021-23663
• Prototype Pollution in backbone-query-parameters - CVE-2021-20085

You might also like:

How to Secure your NodeJs Express Javascript Application - part 1

How to Secure your NodeJs Express Javascript Application - part 2

10 Secure Coding Best Practices to Follow in Every Project

Tags:

npm

lutils