Validation Bypass in kind-of

Description

Versions of kind-of 6.x prior to 6.0.3 are vulnerable to a Validation Bypass. A maliciously crafted object can alter the result of the type check, allowing attackers to bypass the type checking validation.

Recommendation

Update the kind-of package to the latest compatible version. Followings are version details:

• Affected version(s): >= 6.0.0, < 6.0.3
• Patched version(s): 6.0.3

References

• GHSA-6c8f-qphg-qjgp
• snyk.io
• www.npmjs.com
• CVE-2019-20149
• CWE-668
• CAPEC-310
• OWASP 2021-A1
• OWASP 2021-A6

Related Issues

• Validation bypass is possible in Json Pattern Validator - CVE-2019-19507
• Validation Bypass in slp-validate - CVE-2019-16761
• Message Signature Bypass in openpgp - CVE-2019-9153
• Feathers has an origin validation bypass via prefix matching - CVE-2026-27192

You might also like:

Apache and Express Path Traversal plus Nginx Restriction Bypass Tests with SmartScanner

10 Secure Coding Best Practices to Follow in Every Project

Update Cheat Sheet for Developers

Tags:

npm

kind-of