Prototype Pollution in @hapi/hoek
Versions of @hapi/hoek prior to 8.5.1 and 9.0.3 are vulnerable to Prototype Pollution. The clone function fails to prevent the modification of the Object prototype when passed specially-crafted input. Attackers may use this to change existing properties that exist in all objects, which may lead to Denial of Service or Remote Code Execution in specific circumstances.
This issue does not affect hapi applications since the framework protects against such malicious inputs. Applications that use @hapi/hoek outside of the hapi ecosystem may be vulnerable.
Recommendation
Update to version 8.5.1, 9.0.3 or later.
Affected software
Click a technology to see all vulnerabilities affecting it.
| Platform | Package | Vulnerable versions | Fixed in |
|---|---|---|---|
| npm package | @hapi/hoek | >= 8.3.2, < 8.5.1, >= 9.0.0, < 9.0.3 | 8.5.1, 9.0.3 |
References
- Weakness (CWE)
CWE-1321- Platform
- npm
- Package
@hapi/hoek- Disclosed
- 04.09.2020
- Updated
- 11.10.2026 10:22
Sources and licenses
OSV / GitHub Advisory Database - GHSA-22h7-7wwg-qmgg - CC BY 4.0
Vulnerability history: @hapi/hoek
All published vulnerabilities of this package (npm package), newest first. Shows whether this is a one-off slip or a package that needs watching.
- Total entries
- 2
- First → latest
- 09.2020 09.2022
- Without a fix
- 0
- Exploited in attacks
- 0
Severity breakdown
- High 1
- Low 1
Disclosures per year
- 2020: 1
- 2021: 0
- 2022: 1
- 2023: 0
- 2024: 0
- 2025: 0
- 2026: 0
-
Prototype Pollution in @hapi/hoek this entry
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.