Executive brief
merge-options is a JavaScript library used to merge configuration objects in Node.js applications. A prototype pollution vulnerability allows attackers to inject malicious properties into the base JavaScript object prototype, potentially affecting all objects in an application and leading to denial of service, data corruption, or remote code execution depending on how the application uses the polluted objects.
Technical details
The merge-options library fails to properly validate and sanitize property names during object merging, allowing attackers to inject properties into Object.prototype via payloads containing "__proto__" or "constructor.prototype" keys. This prototype pollution vulnerability is triggered when the library merges untrusted or user-supplied configuration objects with legitimate options. An attacker with the ability to provide input to the merge function can pollute the prototype chain, affecting all subsequently created objects. The fix (version 1.0.1 and later) adds proper filtering to prevent assignment to prototype-related properties using Object.defineProperty with restricted attributes.
Affected products
- npm merge-options < 1.0.1
Timeline
- 2018-10-09: disclosed
- 2018-04-30: patched: Fix released in version 1.0.1