Executive brief
node.extend is a popular JavaScript utility library used to merge object properties. Versions before 1.1.7 and 2.0.1 contain a prototype pollution vulnerability that allows attackers to modify JavaScript object prototypes, potentially leading to unauthorized code execution or denial of service in any application that depends on this library.
Technical details
The vulnerability is a prototype pollution flaw in the node.extend library's object merging logic. Attackers can inject malicious properties into JavaScript object prototypes by crafting specially-formed input objects passed to the extend function. This requires no authentication and is triggered via network-reachable code paths that use the vulnerable library. A successful exploit can result in arbitrary code execution, privilege escalation, or application denial of service depending on how the affected application uses extended objects. The fix is available in versions 1.1.7, 2.0.1, and later.
Affected products
- node.extend node.extend before 1.1.7 and 2.0.0
Timeline
- 2019-02-07: disclosed
- 2018: patched: Fix available in versions 1.1.7 and 2.0.1