# CVE-2020-36604: hapi hoek prototype pollution in clone function

Source: https://junglewise.ai/threats/cve-2020-36604-hapi-hoek-prototype-pollution-in-clone-function  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2022-09-25. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2020-36604 · Severity: low · CVSS 3.1 · Published 2022-09-25

hoek is a popular utility library used by Node.js applications for object manipulation and validation. A flaw in the clone() function allows attackers to inject properties into the prototype chain if they can pass a specially crafted object with a "__proto__" key to the function. This prototype pollution could enable unauthorized modification of application behavior or object properties across the entire system.

Vendors: [Hapi](https://junglewise.ai/threats/vendors/hapi).

## Quick answers

**Is CVE-2020-36604 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2020-36604 being exploited in the wild.

**How severe is CVE-2020-36604?** Low severity, with a CVSS score of 3.1, published 25 September 2022.

**Which products and versions are affected?** Hapi Hoek prior to 8.5.1; 9.x prior to 9.0.3.

**Is there a fix for CVE-2020-36604?** A patch was published on 2022-09-25: Patch available in versions 8.5.1 and 9.0.3 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2020-36604 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2020-36604?** Check whether you run Hapi Hoek at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is a prototype pollution flaw (CWE-1321) in the clone() function of hoek versions prior to 8.5.1 and 9.x prior to 9.0.3. When an object containing a "__proto__" key is passed to clone(), the key is incorrectly converted to a prototype property instead of being cloned as a normal object key. Exploitation requires an attacker to inject a malicious object into a code path where clone() is called on untrusted input; in hapi applications, the framework's input validation typically prevents such objects from reaching clone(). The patch, available in versions 8.5.1 and 9.0.3, properly handles the "__proto__" key as a regular property during cloning.

## Affected products

- hapi hoek prior to 8.5.1; 9.x prior to 9.0.3
- hapi @hapi/hoek prior to 8.5.1; 9.x prior to 9.0.3

## Identifiers

- CVE-2020-36604
- GHSA-c429-5p7v-vgjp

## Timeline

- 2020-02-08: disclosed: Issue #352 opened in hapijs/hoek repository
- 2022-09-23: advisory: NVD published CVE-2020-36604
- 2022-09-25: advisory: GitHub advisory GHSA-c429-5p7v-vgjp published
- 2022-09-25: patched: Patch available in versions 8.5.1 and 9.0.3

## References

- [https://github.com/hapijs/hoek/issues/352](https://github.com/hapijs/hoek/issues/352)

## Related threats

- [hapi hoek prototype pollution in clone function](https://junglewise.ai/threats/hapi-hoek-prototype-pollution-in-clone-function-0f3b2840)