GHSA-g64q-3vg8-8f93
Prototype Pollution in pez
All versions of pez are vulnerable to Prototype Pollution. A multipart payload can be constructed in a way that one of the parts’ content can be set as the entire payload object’s prototype. If this prototype contains data, it may bypass other validation rules which enforce access and privacy. If this prototype evaluates to null, it can cause unhandled exceptions when the request payload is accessed.
Recommendation
This package is deprecated and is now maintained as @hapi/pez. Please update your dependencies to use @hapi/pez.
What each source reports
GitHub AdvisoriesNo score
Prototype Pollution in pez
All versions of pez are vulnerable to Prototype Pollution. A multipart payload can be constructed in a way that one of the parts’ content can be set as the entire payload object’s prototype. If this prototype contains data, it may bypass other validation rules which enforce access and privacy. If this prototype evaluates to null, it can cause unhandled exceptions when the request payload is accessed.
Recommendation
This package is deprecated and is now maintained as @hapi/pez. Please update your dependencies to use @hapi/pez.
- Record
GHSA-g64q-3vg8-8f93- Weakness
- CWE-1321
- Updated
- 2026-11-02
OSVNo score
Prototype Pollution in pez
All versions of pez are vulnerable to Prototype Pollution. A multipart payload can be constructed in a way that one of the parts’ content can be set as the entire payload object’s prototype. If this prototype contains data, it may bypass other validation rules which enforce access and privacy. If this prototype evaluates to null, it can cause unhandled exceptions when the request payload is accessed.
Recommendation
This package is deprecated and is now maintained as @hapi/pez. Please update your dependencies to use @hapi/pez.
- Record
GHSA-g64q-3vg8-8f93- Weakness
- CWE-1321
- Updated
- 2026-11-02
Affected packages
| Package | Affected | Fixed |
|---|---|---|
peznpm | 0.0.0 and later | None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | GitHub Advisories, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
GHSA-g64q-3vg8-8f93 is a vulnerability with no CVSS score yet in pez, published September 3, 2020. No source lists public exploit code. No source names a fixed version.