Junglewise Threat Intelligence

CVE-2026-48819: hey-api openapi-ts prototype pollution in buildClientParams

CVE-2026-48819 · Severity: medium · CVSS 4.8 · Published 2026-07-17

Vendors: npm.

Executive brief

Hey API is a tool used to generate software development kits (SDKs) from API specifications. A vulnerability in its code generation template allows attackers to inject malicious data into the internal structures of the generated SDKs. This could lead to unauthorized data being included in API requests or potentially bypass security checks in applications that rely on these generated clients.

Technical details

A prototype pollution vulnerability exists in the `buildClientParams` function within `dist/clients/core/params.ts`. The function fails to validate keys prefixed with slot identifiers (such as `$query_`, `$body_`, etc.), allowing an attacker to provide a key like `$query___proto__`. This results in the application calling `Object.setPrototypeOf` on the internal parameter object using attacker-controlled data. While it does not pollute the global `Object.prototype`, it allows for the injection of inherited properties that appear during `for..in` iteration, potentially affecting downstream request serialization or authorization logic. The issue is fixed in version 0.97.3 by using `Object.create(null)` for slot objects and implementing a blocklist for unsafe keys.

Affected products

  • hey-api openapi-ts < 0.97.3

Timeline

  • 2026-05-19: patched: Fixes committed to repository
  • 2026-05-31: advisory: GitHub Security Advisory published
  • 2026-07-17: disclosed: CVE published to NVD

References