CVE-2019-10746: Critical severity ibm cloud pak for security vulnerability

A vulnerability was found in Nodejs mixin-deep, where mixin-deep is vulnerable to Prototype Pollution in versions before 1.3.2 and version 2.0.0. The function mixin-deep could be tricked into adding or modifying properties of Object.prototype using a constructor payload.

Reference: https://snyk.io/vuln/SNYK-JS-MIXINDEEP-450212

— Red Hat

Node.js mixin-deep module is vulnerable to a denial of service, caused by a prototype pollution flaw. By sending a specially-crafted request using a constructor payload, a remote attacker could exploit this vulnerability to inject properties onto Object.prototype to cause a denial of service condition.

— IBM

Versions of mixin-deep prior to 2.0.1 or 1.3.2 are vulnerable to Prototype Pollution. The mixinDeep function fails to validate which Object properties it updates. This allows attackers to modify the prototype of Object, causing the addition or modification of an existing property on all objects.

Recommendation

If you are using mixin-deep 2.x, upgrade to version 2.0.1 or later. If you are using mixin-deep 1.x, upgrade to version 1.3.2 or later.