Executive brief
The @ndhoule/defaults library is a Node.js package used to merge configuration objects with default values. A prototype pollution vulnerability in the library's deep merge function allows attackers to inject malicious properties into the global prototype chain, causing application denial of service and potentially enabling arbitrary code execution if the polluted properties are passed to sensitive APIs.
Technical details
A prototype pollution vulnerability exists in the lib.deep function of @ndhoule/defaults v2.0.1, allowing attackers to inject properties into the JavaScript global prototype chain via specially crafted payloads (e.g., {"__proto__":{"pollutedKey":123}}). The vulnerable deepCombiner function at index.js:74 does not properly sanitize or filter object keys during merging, enabling the __proto__ property to pollute Object.prototype. An attacker can supply a crafted payload to the deep function without authentication or special privileges. This can cause denial of service by corrupting global object prototypes, and may escalate to arbitrary code execution if polluted properties are consumed by sensitive Node.js APIs like exec() or eval(). No patch has been publicly released as of the advisory date.
Affected products
- ndhoule @ndhoule/defaults 2.0.1 and all previous versions
Timeline
- 2025-02-06: disclosed: CVE-2024-57066 published; GHSA-79h2-v6hh-wq23 advisory released