# CVE-2019-20149: kind-of validation bypass via malicious constructor property

Source: https://junglewise.ai/threats/cve-2019-20149-kind-of-validation-bypass-via-malicious-constructor-property  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2020-03-31. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2019-20149 · Severity: low · CVSS 3.1 · Published 2020-03-31

kind-of is a popular Node.js library used to determine the type of JavaScript values. A validation bypass vulnerability allows attackers to craft malicious objects that trick the type checking logic, potentially causing applications that rely on kind-of's output to accept invalid data or bypass type-based security controls.

Vendors: [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2019-20149 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2019-20149 being exploited in the wild.

**How severe is CVE-2019-20149?** Low severity, with a CVSS score of 3.1, published 31 March 2020.

**Which products and versions are affected?** kind-of (npm) SEMVER:introduced=6.0.0,fixed=6.0.3.

**Is there a fix for CVE-2019-20149?** Yes. kind-of (npm): upgrade to 6.0.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2019-20149 attacked?** It is attacked over the network.

**Am I affected by CVE-2019-20149?** Check whether you run kind-of (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- kind-of (npm): upgrade to 6.0.3 or later

  ```sh
  npm install kind-of@6.0.3
  ```


## Technical details

The vulnerability is a validation bypass in kind-of versions 6.0.0 through 6.0.2, where the ctorName() function unsafely accesses the constructor property of user-supplied objects without verifying that the constructor is actually a function. An attacker can craft a JSON payload or JavaScript object with a malicious "constructor" property (e.g., {"constructor":{"name":"Symbol"}}) to override type detection results. The attack is local/internal (requires application to process attacker-controlled input), and an attacker can cause the type-checking function to return incorrect type names, allowing downstream security checks or validations to be bypassed. The fix, released in version 6.0.3, adds a typeof check to verify that val.constructor is actually a function before accessing its name property.

## Affected products

- jonschlinkert kind-of 6.0.0 to 6.0.2

## Identifiers

- CVE-2019-20149
- GHSA-6c8f-qphg-qjgp

## Timeline

- 2019-12-16: disclosed: Issue opened on GitHub
- 2020-03-31: advisory: GHSA and CVE published
- 2020-03-31: patched: Fix released in version 6.0.3

## References

- [https://github.com/jonschlinkert/kind-of/issues/30](https://github.com/jonschlinkert/kind-of/issues/30)