CVE-2020-36604

hoek subject to prototype pollution via the clone function.

8.1 HighFix available

hoek before 8.5.1 and 9.x before 9.0.3 allows prototype poisoning in the clone function.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: High
Privileges needed: None
User interaction: None

What an attacker can affect

Confidentiality: High
Integrity: High
Availability: High

Exploit likelihood

1.24%Up 0.4 points since Sep 23, 2022

What each source reports

NVD Score used 8.1

hoek before 8.5.1 and 9.x before 9.0.3 allows prototype poisoning in the clone function.

Record: CVE-2020-36604
CVSS 3.1: 8.1 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness: CWE-1321
Updated: 2026-11-02

CVE List 8.1

hoek before 8.5.1 and 9.x before 9.0.3 allows prototype poisoning in the clone function.

Record: CVE-2020-36604
CVSS 3.1: 8.1 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness: CWE-1321
Updated: 2026-11-02

EUVDEUVD-2022-6771 8.1

hoek before 8.5.1 and 9.x before 9.0.3 allows prototype poisoning in the clone function.

Record: EUVD-2022-6771
CVSS 3.1: 8.1 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

GitHub AdvisoriesGHSA-c429-5p7v-vgjp 8.1

hoek subject to prototype pollution via the clone function.

hoek versions prior to 8.5.1, and 9.x prior to 9.0.3 are vulnerable to prototype pollution in the clone function. If an object with the proto key is passed to clone() the key is converted to a prototype. This issue has been patched in version 9.0.3, and backported to 8.5.1.

Record: GHSA-c429-5p7v-vgjp
CVSS 3.1: 8.1 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness: CWE-1321
Updated: 2026-11-02

OSV 8.1

hoek before 8.5.1 and 9.x before 9.0.3 allows prototype poisoning in the clone function.

Record: CVE-2020-36604
CVSS 3.1: 8.1 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVDEBIAN-CVE-2020-36604 8.1

hoek before 8.5.1 and 9.x before 9.0.3 allows prototype poisoning in the clone function.

Record: DEBIAN-CVE-2020-36604
CVSS 3.1: 8.1 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

Show 10 moreShow less

OSVGHSA-c429-5p7v-vgjp 8.1

hoek subject to prototype pollution via the clone function.

Record: GHSA-c429-5p7v-vgjp
CVSS 3.1: 8.1 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness: CWE-1321
Updated: 2026-11-02

OSVROOT-APP-NPM-CVE-2020-36604 8.1

CVE-2020-36604 in hoek - Patched by Root

Root has patched CVE-2020-36604 in the hoek package for Root:npm. Multiple fixed versions available.

Record: ROOT-APP-NPM-CVE-2020-36604
CVSS 3.1: 8.1 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-06

OSVUBUNTU-CVE-2020-36604 8.1

hoek before 8.5.1 and 9.x before 9.0.3 allows prototype poisoning in the clone function.

Record: UBUNTU-CVE-2020-36604
CVSS 3.1: 8.1 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVCLSA-2026-1772583211 No score

TuxCare security update for hoek (2 CVEs)

TuxCare rebuilt hoek to address 2 CVEs. Fixed in 2.16.3-tuxcare.1.

Record: CLSA-2026-1772583211
Updated: 2026-11-02

OSVCLSA-2026-1773015267 No score

TuxCare security update for hoek (2 CVEs)

TuxCare rebuilt hoek to address 2 CVEs. Fixed in 2.11.1-tuxcare.1.

Record: CLSA-2026-1773015267
Updated: 2026-11-02

OSVCLSA-2026-1773274552 No score

TuxCare security update for hoek (2 CVEs)

TuxCare rebuilt hoek to address 2 CVEs. Fixed in 2.14.0-tuxcare.1.

Record: CLSA-2026-1773274552
Updated: 2026-11-02

OSVCLSA-2026-1773274559 No score

TuxCare security update for hoek (2 CVEs)

TuxCare rebuilt hoek to address 2 CVEs. Fixed in 2.12.0-tuxcare.1.

Record: CLSA-2026-1773274559
Updated: 2026-11-02

OSVCLSA-2026-1774743819 No score

TuxCare security update for hoek (2 CVEs)

TuxCare rebuilt hoek to address 2 CVEs. Fixed in 0.8.5-tuxcare.1.

Record: CLSA-2026-1774743819
Updated: 2026-11-02

OSVCLSA-2026-1774743820 No score

TuxCare security update for hoek (2 CVEs)

TuxCare rebuilt hoek to address 2 CVEs. Fixed in 0.9.1-tuxcare.1.

Record: CLSA-2026-1774743820
Updated: 2026-11-02

OSVCLSA-2026-1778633138 No score

TuxCare security update for hoek (1 CVE)

TuxCare rebuilt hoek to address 1 CVE. Fixed in 4.2.1-tuxcare.1.

Record: CLSA-2026-1778633138
Updated: 2026-11-02

Affected products

hapijs hoek

Affected packages

Affected packages
Package	Affected	Fixed
`@hapi/hoek` npm	before 8.5.1	8.5.1
`@hapi/hoek` npm	9.0.0 up to 9.0.3	9.0.3
`hoek` npm	through 6.1.3	None known
`hoek` TuxCare:npm From an advisory covering 2 CVEs	2.16.3-tuxcare.0 up to 2.16.3-tuxcare.1, plus listed versions 2.16.3	2.16.3-tuxcare.1
`hoek` TuxCare:npm From an advisory covering 2 CVEs	2.11.1-tuxcare.0 up to 2.11.1-tuxcare.1, plus listed versions 2.11.1	2.11.1-tuxcare.1
`hoek` TuxCare:npm From an advisory covering 2 CVEs	2.14.0-tuxcare.0 up to 2.14.0-tuxcare.1, plus listed versions 2.14.0	2.14.0-tuxcare.1
`hoek` TuxCare:npm From an advisory covering 2 CVEs	2.12.0-tuxcare.0 up to 2.12.0-tuxcare.1, plus listed versions 2.12.0	2.12.0-tuxcare.1
`hoek` TuxCare:npm From an advisory covering 2 CVEs	0.8.5-tuxcare.0 up to 0.8.5-tuxcare.1, plus listed versions 0.8.5	0.8.5-tuxcare.1
`hoek` TuxCare:npm From an advisory covering 2 CVEs	0.9.1-tuxcare.0 up to 0.9.1-tuxcare.1, plus listed versions 0.9.1	0.9.1-tuxcare.1
`hoek` TuxCare:npm	4.2.1-tuxcare.0 up to 4.2.1-tuxcare.1, plus listed versions 4.2.1	4.2.1-tuxcare.1

Show 7 moreShow less

Affected packages
Package	Affected	Fixed
`node-hoek` Debian:12	before 9.0.3+~5.0.0+~4.0.0-1	9.0.3+~5.0.0+~4.0.0-1
`node-hoek` Debian:13	before 9.0.3+~5.0.0+~4.0.0-1	9.0.3+~5.0.0+~4.0.0-1
`node-hoek` Debian:14	before 9.0.3+~5.0.0+~4.0.0-1	9.0.3+~5.0.0+~4.0.0-1
`hoek` Root:npm	before 4.3.1-aikido.1	4.3.1-aikido.12.16.3-aikido.1
`@rootio/hoek` Root:npm	before 4.3.1-root.io.1	4.3.1-root.io.12.16.3-root.io.1
`node-hoek` Ubuntu:18.04:LTS	All versions, plus listed versions 4.1.0-2	None known
`node-hoek` Ubuntu:20.04:LTS	All versions, plus listed versions 8.2.4+~4.2.1+~3.3.1-38.5.0+~4.2.1+~3.3.1-1	None known

History

History
Recorded	Changed	Sources
Nov 6, 2026	affected	OSV
Nov 6, 2026	affected, facts
Nov 2, 2026	first indexed	CVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2020-36604 is a high vulnerability (CVSS 8.1) in Hapijs Hoek, published September 23, 2022. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.24%, the 69th percentile. Fixed in @hapi/hoek 8.5.1.

References

Show 4 moreShow less