Validation Bypass in kind-of

Description

Versions of kind-of 6.x prior to 6.0.3 are vulnerable to a Validation Bypass. A maliciously crafted object can alter the result of the type check, allowing attackers to bypass the type checking validation.

Recommendation

Update the kind-of package to the latest compatible version. Followings are version details:

• Affected version(s): >= 6.0.0, < 6.0.3
• Patched version(s): 6.0.3

References

• GHSA-6c8f-qphg-qjgp
• snyk.io
• www.npmjs.com
• CVE-2019-20149
• CWE-668
• CAPEC-310
• OWASP 2021-A1
• OWASP 2021-A6

Related Issues

• Validation Bypass in schema-inspector - CVE-2019-10781
• validator.js has a URL validation bypass vulnerability in its isURL function - CVE-2025-56200
• Validation bypass in frourio-express - CVE-2022-23624
• Validation bypass in frourio - CVE-2022-23623

Tags:

npm

kind-of