Executive brief
pez is a Node.js library for parsing multipart HTTP payloads, commonly used in web servers and APIs. A prototype pollution vulnerability allows attackers to inject malicious data into the object prototype through specially crafted multipart requests, potentially bypassing validation rules, exposing sensitive data, or crashing the application.
Technical details
The vulnerability is a prototype pollution (CWE-1321) flaw in all versions of pez affecting multipart payload parsing. An attacker can construct a multipart payload where one part's content is set as the entire payload object's prototype. If the injected prototype contains data, it can bypass access and privacy validation rules. If the prototype evaluates to null, unhandled exceptions may be triggered when the payload is accessed. The fix is available in pez v4.1.2 and later; the package is now maintained as @hapi/pez.
Affected products
- pez pez all versions up to 4.1.1
Timeline
- 2020-09-03: disclosed
- 2020-02-13: patched: fix released in v4.1.2