Executive brief
extend2 is a JavaScript utility library that merges objects together, commonly used in Node.js applications. A prototype pollution vulnerability allows attackers to inject properties into the base JavaScript object prototype, potentially compromising all objects in an application and leading to unexpected behavior, unauthorized access, or code execution.
Technical details
The vulnerability is a prototype pollution flaw (CWE-1321) in the extend2 library's recursive merge function, which unsafely handles the __proto__ property during object merging. An attacker can supply a specially crafted object that pollutes the global Object prototype by injecting arbitrary properties, affecting all downstream objects. The vulnerability is network-reachable if extend2 processes untrusted input from network requests or user-supplied data, and no authentication is required. An attacker can alter application behavior, bypass security checks, or execute code depending on how the application uses the extended objects. The vulnerability is fixed in version 1.0.1 and later.
Affected products
- eggjs extend2 before 1.0.1
Timeline
- 2022-01-12: disclosed
- 2022-01-12: patched: Fixed in version 1.0.1