Validation Bypass in kind-of

Description

Versions of kind-of 6.x prior to 6.0.3 are vulnerable to a Validation Bypass. A maliciously crafted object can alter the result of the type check, allowing attackers to bypass the type checking validation.

Recommendation

Update the kind-of package to the latest compatible version. Followings are version details:

• Affected version(s): >= 6.0.0, < 6.0.3
• Patched version(s): 6.0.3

References

• GHSA-6c8f-qphg-qjgp
• snyk.io
• www.npmjs.com
• CVE-2019-20149
• CWE-668
• CAPEC-310
• OWASP 2021-A1
• OWASP 2021-A6

Related Issues

• Validation Bypass in schema-inspector - CVE-2019-10781
• Saltcorn: Open Redirect in `POST /auth/login` due to incomplete `is_relative_url` validation (backslash bypass) - CVE-2026-42259
• Parse Server: JWT audience validation bypass in Google, Apple, and Facebook authentication adapters - CVE-2026-30863
• Parse Server has an auth provider validation bypass on login via partial authData - CVE-2026-33409

You might also like:

Apache and Express Path Traversal plus Nginx Restriction Bypass Tests with SmartScanner

10 Secure Coding Best Practices to Follow in Every Project

Update Cheat Sheet for Developers

Tags:

npm

kind-of