Prototype pollution in min-dash

Description

The set method is vulnerable to prototype pollution with specially crafted inputs.

Recommendation

Update the min-dash package to the latest compatible version. Followings are version details:

• Affected version(s): < 3.8.1
• Patched version(s): 3.8.1

References

• GHSA-2m53-83f3-562j
• snyk.io
• CVE-2021-23460
• CWE-1321
• CAPEC-310
• OWASP 2021-A6

Related Issues

• json-schema is vulnerable to Prototype Pollution - CVE-2021-3918
• Prototype pollution vulnerability in js-extend - CVE-2021-25945
• Prototype Pollution in immer - immer - GHSA-c36v-fmgq-m8hx - CVE-2021-3757
• jquery-plugin-query-object contains prototype pollution vulnerability - CVE-2021-20083

You might also like:

How to Secure your NodeJs Express Javascript Application - part 1

How to Secure your NodeJs Express Javascript Application - part 2

10 Secure Coding Best Practices to Follow in Every Project

Tags:

npm

min-dash