CVE-2018-16492: Critical severity extend vulnerability
A prototype pollution vulnerability was found in module extend <2.0.2, ~<3.0.2 that allows an attacker to inject arbitrary properties onto Object.prototype.
Other sources
Node.js extend module is vulnerable to a denial of service, caused by a prototype pollution flaw. By sending a specially-crafted request, a remote attacker could exploit this vulnerability to inject properties onto Object.prototype to cause a denial of service condition.
— IBM
nodejs-extend before versions 2.0.2 and 3.0.2 is vulnerable to prototype pollution. Utilities function can be tricked into modifying the prototype of "Object" when the attacker control part of the structure passed to these function. This can let an attacker add or modify existing property that will exist on all object.
External Reference:
https://snyk.io/vuln/npm:extend:20180424
Upstream Patch:
https://github.com/justmoon/node-extend/commit/0e68e71d93507fcc391e398bc84abd0666b28190
Upstream Pull Request:
https://github.com/justmoon/node-extend/pull/48
— Red Hat
Affected Software
Event History
Frequently Asked Questions
What is CVE-2018-16492?
CVE-2018-16492 is a vulnerability in the Node.js extend module that allows an attacker to perform a denial-of-service attack by injecting properties onto Object.prototype.
How severe is CVE-2018-16492?
CVE-2018-16492 has a severity rating of 9.8, which is classified as critical.
How does CVE-2018-16492 affect Node.js extend module?
CVE-2018-16492 affects Node.js extend module versions 2.0.2 up to exclusive version 3.0.2.
How can an attacker exploit CVE-2018-16492?
An attacker can exploit CVE-2018-16492 by sending a specially-crafted request to the vulnerable server.
Is there a fix for CVE-2018-16492?
Yes, the fix for CVE-2018-16492 is to update the Node.js extend module to version 3.0.2 or higher.