Prototype pollution in nestie

Description

Prototype pollution vulnerability in ‘nestie’ versions 0.0.0 through 1.0.0 allows an attacker to cause a denial of service and may lead to remote code execution.

Recommendation

Update the nestie package to the latest compatible version. Followings are version details:

• Affected version(s): < 1.0.1
• Patched version(s): 1.0.1

References

• GHSA-m7rg-8wvq-846v
• www.whitesourcesoftware.com
• CVE-2021-25947
• CWE-1321
• CWE-913
• CAPEC-310
• OWASP 2021-A1
• OWASP 2021-A6

Related Issues

• json-schema is vulnerable to Prototype Pollution - CVE-2021-3918
• Prototype Pollution in async - CVE-2021-43138
• Prototype Pollution in cookiex/deep - CVE-2021-23442
• Prototype Pollution in js-data - js-data - CVE-2021-23574

You might also like:

How to Secure your NodeJs Express Javascript Application - part 1

How to Secure your NodeJs Express Javascript Application - part 2

10 Secure Coding Best Practices to Follow in Every Project

Tags:

npm

nestie