Prototype pollution in @hapi hoek node module
Priority MEDIUM 45CWE-471Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Partial Red Hat: 2 fixed, 3 without a fix
Attack profile from CVSS 3.0 · NVD. Fix status from CNA, GitHub and Red Hat.
Summary
hoek node module before 4.2.0 and 5.0.x before 5.0.3 suffers from a Modification of Assumed-Immutable Data (MAID) vulnerability via 'merge' and 'applyToDefaults' functions, which allows a malicious user to modify the prototype of "Object" via __proto__, causing the addition or modification of an existing property that will exist on all objects.
Why it matters now
EPSS 0.0419 90th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Partial hoek node module (hapi): 5.0.3hoek (npm): 5.0.3, 4.2.1Red Hat: 3 advisoriesRed Hat: 2 fixed, 3 without a fix
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| @hapi | hoek node module | before 5.0.3 | 5.0.3 | Patch available | CNA |
| — | hoek (npm) | 5.0.0 to before 5.0.3 | 5.0.3 | Patch available | GHSA-jp4x-w63m-7wgm |
| — | hoek (npm) | before 4.2.1 | 4.2.1 | Patch available | GHSA-jp4x-w63m-7wgm |
- hoek node module Vendor@hapi Affected before 5.0.3 Fixed in 5.0.3 Patch available CNA
- hoek (npm) Vendor— Affected 5.0.0 to before 5.0.3 Fixed in 5.0.3 Patch available GHSA-jp4x-w63m-7wgm
- hoek (npm) Vendor— Affected before 4.2.1 Fixed in 4.2.1 Patch available GHSA-jp4x-w63m-7wgm
Remediation
- Fix · CNA hoek node module (hapi) Fixed in 5.0.3
- Fix · GHSA-jp4x-w63m-7wgm hoek (npm) Fixed in 5.0.3 Advisory →
- Fix · GHSA-jp4x-w63m-7wgm hoek (npm) Fixed in 4.2.1 Advisory →
Red Hat 3 advisories
- RHSA-2021:3917 Released 2021-10-19 · Red Hat rating ImportantRed Hat Quay v3.6.0 security, bug fix and enhancement update
- Quay v3 quay/quay-rhel8
- RHSA-2018:1263 Released 2018-04-30 · Red Hat rating ModerateRed Hat Mobile Application Platform 4.6.0 release - RPMs
- Red Hat Mobile Application Platform 4.6 fh-system-dump-tool-1.0.0-5.el7, fping-3.10-4.el7map, nagios-4.0.8-8.el7map +47
- RHSA-2018:1264 Released 2018-04-30 · Red Hat rating ModerateRed Hat Mobile Application Platform 4.6.0 Release - Container Images
- Red Hat Mobile Application Platform 4.6 rhmap46/fh-aaa, rhmap46/fh-appstore, rhmap46/fh-mbaas +18
Vendor assessments
Red Hat
Red Hat rating: Low. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat Enterprise Linux 8 | Affected | No fix planned: Will not fix |
| Red Hat OpenShift Enterprise 3 | Affected | No fix planned: Will not fix |
| Red Hat Software Collections | Affected | No fix planned: Will not fix |
| Quay v3 | Fixed | RHSA-2021:3917 |
| Red Hat Mobile Application Platform 4.6 | Fixed | RHSA-2018:1263, RHSA-2018:1264 |
Not affected: 2 products
- Quay v3
- Red Hat Virtualization 4
Timeline
- 2026-10-02 Threatist record created from CVE-2018-3728
- 2026-10-03 Alias added: GHSA-jp4x-w63m-7wgm
References
Exploit 1
More @hapi vulnerabilities
- TI-2026-82716 Quadratic-time split in joi email rule allows denial of service CVSS 3.1HIGH 7.5
- TI-2014-08224 Path traversal in HackerOne inert node module CVSS 3.1HIGH 7.5
- TI-2023-10628 Regular expression denial of service (ReDoS) in hapijs formula CVSS 3.1MEDIUM 6.5
Sources
- CVE-2018-3728 · CVE Program
- CVE-2018-3728 · NVD
- FIRST EPSS
- GHSA-jp4x-w63m-7wgm · GitHub Advisory Database · CC BY 4.0
- CVE-2018-3728 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences