robinweser fast-loops vulnerable to prototype pollution

Description

robinweser fast-loops v1.1.3 was discovered to contain a prototype pollution via the function objectMergeDeep. This vulnerability allows attackers to execute arbitrary code or cause a Denial of Service (DoS) via injecting arbitrary properties.

Recommendation

Update the fast-loops package to the latest compatible version. Followings are version details:

• Affected version(s): < 1.1.4
• Patched version(s): 1.1.4

References

• GHSA-3q56-9cc2-46j4
• CVE-2024-39008
• CWE-1321
• CAPEC-310
• OWASP 2021-A6

Related Issues

• fast-xml-parser vulnerable to Prototype Pollution through tag or attribute name - CVE-2023-26920
• depath and cool-path vulnerable to Prototype Pollution via `set()` Method - CVE-2024-38985
• node-gettext vulnerable to Prototype Pollution - CVE-2024-21528
• depath and cool-path vulnerable to Prototype Pollution via `set()` Method - depath - CVE-2024-38985

You might also like:

How to Secure your NodeJs Express Javascript Application - part 1

How to Secure your NodeJs Express Javascript Application - part 2

10 Secure Coding Best Practices to Follow in Every Project

Tags:

npm

fast-loops