{"id":"CVE-2018-3728","aliases":["CLSA-2026-1772583211","CLSA-2026-1773015267","CLSA-2026-1773274552","CLSA-2026-1773274559","CLSA-2026-1774743819","CLSA-2026-1774743820","DEBIAN-CVE-2018-3728","EUVD-2018-0190","GHSA-jp4x-w63m-7wgm","RHSA-2018:1263","ROOT-APP-NPM-CVE-2018-3728","UBUNTU-CVE-2018-3728"],"status":"published","title":"Prototype Pollution in hoek","description":"hoek node module before 4.2.0 and 5.0.x before 5.0.3 suffers from a Modification of Assumed-Immutable Data (MAID) vulnerability via 'merge' and 'applyToDefaults' functions, which allows a malicious user to modify the prototype of \"Object\" via __proto__, causing the addition or modification of an existing property that will exist on all objects.","severity":{"version":"3.0","score":8.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.0419,"percentile":0.91,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-1321","CWE-471"],"published":"2018-03-30T19:00:00Z","modified":"2026-11-06T12:15:02Z","fixes":[{"ecosystem":"npm","package":"hoek","fixed_in":["5.0.3","4.2.1"],"sources":["ghsa","osv"]},{"ecosystem":"Debian:12","package":"node-hoek","fixed_in":["5.0.3-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"node-hoek","fixed_in":["5.0.3-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"node-hoek","fixed_in":["5.0.3-1"],"sources":["osv"]},{"ecosystem":"Root:npm","package":"hoek","fixed_in":["2.16.3-aikido.1"],"sources":["osv"]},{"ecosystem":"Root:npm","package":"@rootio/hoek","fixed_in":["2.16.3-root.io.1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"hoek","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.0.0"},{"fixed":"5.0.3"}]}]},{"source":"ghsa","ecosystem":"npm","package":"hoek","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.1"}]}]},{"source":"osv","ecosystem":"TuxCare:npm","package":"hoek","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.16.3-tuxcare.0"},{"fixed":"2.16.3-tuxcare.1"}]}],"versions":["2.16.3"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:npm","package":"hoek","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.11.1-tuxcare.0"},{"fixed":"2.11.1-tuxcare.1"}]}],"versions":["2.11.1"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:npm","package":"hoek","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.14.0-tuxcare.0"},{"fixed":"2.14.0-tuxcare.1"}]}],"versions":["2.14.0"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:npm","package":"hoek","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.12.0-tuxcare.0"},{"fixed":"2.12.0-tuxcare.1"}]}],"versions":["2.12.0"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:npm","package":"hoek","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.8.5-tuxcare.0"},{"fixed":"0.8.5-tuxcare.1"}]}],"versions":["0.8.5"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:npm","package":"hoek","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.9.1-tuxcare.0"},{"fixed":"0.9.1-tuxcare.1"}]}],"versions":["0.9.1"],"bundled":2},{"source":"osv","ecosystem":"Debian:12","package":"node-hoek","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.0.3-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"node-hoek","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.0.3-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"node-hoek","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.0.3-1"}]}]},{"source":"osv","ecosystem":"npm","package":"hoek","ranges":[{"type":"SEMVER","events":[{"introduced":"5.0.0"},{"fixed":"5.0.3"}]}]},{"source":"osv","ecosystem":"npm","package":"hoek","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"4.2.1"}]}]},{"source":"osv","ecosystem":"Red Hat:mobile_application_platform:4.6","package":"fh-system-dump-tool","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.0-5.el7"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:mobile_application_platform:4.6","package":"fping","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.10-4.el7map"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:mobile_application_platform:4.6","package":"fping-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.10-4.el7map"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:mobile_application_platform:4.6","package":"nagios","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.0.8-8.el7map"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:mobile_application_platform:4.6","package":"nagios-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.0.8-8.el7map"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:mobile_application_platform:4.6","package":"nagios-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.0.8-8.el7map"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:mobile_application_platform:4.6","package":"nagios-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.0.8-8.el7map"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:mobile_application_platform:4.6","package":"nagios-plugins","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.3-3.el7map"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:mobile_application_platform:4.6","package":"nagios-plugins-all","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.3-3.el7map"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:mobile_application_platform:4.6","package":"nagios-plugins-apt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.3-3.el7map"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:mobile_application_platform:4.6","package":"nagios-plugins-breeze","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.3-3.el7map"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:mobile_application_platform:4.6","package":"nagios-plugins-by_ssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.3-3.el7map"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:mobile_application_platform:4.6","package":"nagios-plugins-cluster","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.3-3.el7map"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:mobile_application_platform:4.6","package":"nagios-plugins-dbi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.3-3.el7map"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:mobile_application_platform:4.6","package":"nagios-plugins-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.3-3.el7map"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:mobile_application_platform:4.6","package":"nagios-plugins-dhcp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.3-3.el7map"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:mobile_application_platform:4.6","package":"nagios-plugins-dig","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.3-3.el7map"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:mobile_application_platform:4.6","package":"nagios-plugins-disk","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.3-3.el7map"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:mobile_application_platform:4.6","package":"nagios-plugins-disk_smb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.3-3.el7map"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:mobile_application_platform:4.6","package":"nagios-plugins-dns","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.3-3.el7map"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:mobile_application_platform:4.6","package":"nagios-plugins-dummy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.3-3.el7map"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:mobile_application_platform:4.6","package":"nagios-plugins-file_age","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.3-3.el7map"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:mobile_application_platform:4.6","package":"nagios-plugins-flexlm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.3-3.el7map"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:mobile_application_platform:4.6","package":"nagios-plugins-fping","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.3-3.el7map"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:mobile_application_platform:4.6","package":"nagios-plugins-game","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.3-3.el7map"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:mobile_application_platform:4.6","package":"nagios-plugins-hpjd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.3-3.el7map"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:mobile_application_platform:4.6","package":"nagios-plugins-http","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.3-3.el7map"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:mobile_application_platform:4.6","package":"nagios-plugins-icmp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.3-3.el7map"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:mobile_application_platform:4.6","package":"nagios-plugins-ide_smart","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.3-3.el7map"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:mobile_application_platform:4.6","package":"nagios-plugins-ifoperstatus","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.3-3.el7map"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:mobile_application_platform:4.6","package":"nagios-plugins-ifstatus","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.3-3.el7map"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:mobile_application_platform:4.6","package":"nagios-plugins-ircd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.3-3.el7map"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:mobile_application_platform:4.6","package":"nagios-plugins-ldap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.3-3.el7map"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:mobile_application_platform:4.6","package":"nagios-plugins-load","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.3-3.el7map"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:mobile_application_platform:4.6","package":"nagios-plugins-log","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.3-3.el7map"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:mobile_application_platform:4.6","package":"nagios-plugins-mailq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.3-3.el7map"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:mobile_application_platform:4.6","package":"nagios-plugins-mrtg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.3-3.el7map"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:mobile_application_platform:4.6","package":"nagios-plugins-mrtgtraf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.3-3.el7map"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:mobile_application_platform:4.6","package":"nagios-plugins-mysql","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.3-3.el7map"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:mobile_application_platform:4.6","package":"nagios-plugins-nagios","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.3-3.el7map"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:mobile_application_platform:4.6","package":"nagios-plugins-nt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.3-3.el7map"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:mobile_application_platform:4.6","package":"nagios-plugins-ntp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.3-3.el7map"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:mobile_application_platform:4.6","package":"nagios-plugins-ntp-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.3-3.el7map"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:mobile_application_platform:4.6","package":"nagios-plugins-nwstat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.3-3.el7map"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:mobile_application_platform:4.6","package":"nagios-plugins-oracle","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.3-3.el7map"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:mobile_application_platform:4.6","package":"nagios-plugins-overcr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.3-3.el7map"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:mobile_application_platform:4.6","package":"nagios-plugins-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.3-3.el7map"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:mobile_application_platform:4.6","package":"nagios-plugins-pgsql","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.3-3.el7map"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:mobile_application_platform:4.6","package":"nagios-plugins-ping","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.3-3.el7map"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:mobile_application_platform:4.6","package":"nagios-plugins-procs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.3-3.el7map"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:mobile_application_platform:4.6","package":"nagios-plugins-radius","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.3-3.el7map"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:mobile_application_platform:4.6","package":"nagios-plugins-real","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.3-3.el7map"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:mobile_application_platform:4.6","package":"nagios-plugins-rpc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.3-3.el7map"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:mobile_application_platform:4.6","package":"nagios-plugins-sensors","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.3-3.el7map"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:mobile_application_platform:4.6","package":"nagios-plugins-smtp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.3-3.el7map"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:mobile_application_platform:4.6","package":"nagios-plugins-snmp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.3-3.el7map"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:mobile_application_platform:4.6","package":"nagios-plugins-ssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.3-3.el7map"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:mobile_application_platform:4.6","package":"nagios-plugins-swap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.3-3.el7map"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:mobile_application_platform:4.6","package":"nagios-plugins-tcp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.3-3.el7map"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:mobile_application_platform:4.6","package":"nagios-plugins-time","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.3-3.el7map"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:mobile_application_platform:4.6","package":"nagios-plugins-ups","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.3-3.el7map"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:mobile_application_platform:4.6","package":"nagios-plugins-uptime","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.3-3.el7map"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:mobile_application_platform:4.6","package":"nagios-plugins-users","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.3-3.el7map"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:mobile_application_platform:4.6","package":"nagios-plugins-wave","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.3-3.el7map"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:mobile_application_platform:4.6","package":"perl-Crypt-CBC","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.33-2.el7map"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:mobile_application_platform:4.6","package":"perl-Crypt-DES","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.05-20.el7map"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:mobile_application_platform:4.6","package":"perl-Crypt-DES-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.05-20.el7map"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:mobile_application_platform:4.6","package":"perl-Net-SNMP","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.1-7.el7map"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:mobile_application_platform:4.6","package":"phantomjs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.9.7-3.el7map"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:mobile_application_platform:4.6","package":"phantomjs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.9.7-3.el7map"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:mobile_application_platform:4.6","package":"python-meld3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.6.10-1.el7map"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:mobile_application_platform:4.6","package":"python-meld3-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.6.10-1.el7map"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:mobile_application_platform:4.6","package":"qstat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.11-13.20080912svn311.el7map"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:mobile_application_platform:4.6","package":"qstat-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.11-13.20080912svn311.el7map"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:mobile_application_platform:4.6","package":"radiusclient-ng","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.5.6-9.el7map"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:mobile_application_platform:4.6","package":"radiusclient-ng-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.5.6-9.el7map"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:mobile_application_platform:4.6","package":"radiusclient-ng-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.5.6-9.el7map"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:mobile_application_platform:4.6","package":"radiusclient-ng-utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.5.6-9.el7map"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:mobile_application_platform:4.6","package":"redis","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.8.21-2.el7map"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:mobile_application_platform:4.6","package":"redis-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.8.21-2.el7map"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:mobile_application_platform:4.6","package":"rhmap-fh-openshift-templates","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.6.0-5.el7"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:mobile_application_platform:4.6","package":"rhmap-mod_authnz_external","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.3.1-7.el7map"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:mobile_application_platform:4.6","package":"rhmap-mod_authnz_external-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.3.1-7.el7map"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:mobile_application_platform:4.6","package":"sendEmail","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.56-2.el7"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:mobile_application_platform:4.6","package":"ssmtp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.64-14.el7map"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:mobile_application_platform:4.6","package":"ssmtp-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.64-14.el7map"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:mobile_application_platform:4.6","package":"supervisor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.3-3.el7map"}]}],"bundled":2},{"source":"osv","ecosystem":"Root:npm","package":"hoek","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.16.3-aikido.1"}]}]},{"source":"osv","ecosystem":"Root:npm","package":"@rootio/hoek","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.16.3-root.io.1"}]}]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"node-hoek","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.1.0-2"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"node-hoek","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["8.2.4+~4.2.1+~3.3.1-3","8.5.0+~4.2.1+~3.3.1-1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"node-hoek","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["9.1.0+~cs10.1.0-1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"node-hoek","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["10.0.1+~cs12.0.0-1"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"node-hoek","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["10.0.1+~cs12.0.0-1"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"node-hoek","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["10.0.1+~cs12.0.0-1","11.0.7+~cs12.0.2-1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"node-hoek","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["10.0.1+~cs12.0.0-1"]}],"products":[{"vendor":"hapi","product":"hoek node module"},{"vendor":"hapijs","product":"hoek"}],"references":[{"url":"https://github.com/hapijs/hoek/commit/32ed5c9413321fbc37da5ca81a7cbab693786dee","tags":["x_refsource_CONFIRM","x_transferred","Patch","Third Party Advisory","fix","web"]},{"url":"https://hackerone.com/reports/310439","tags":["x_refsource_MISC","x_transferred","Exploit","Third Party Advisory","evidence","web"]},{"url":"http://www.securityfocus.com/bid/103108","tags":["vdb-entry","x_refsource_BID","x_transferred","Third Party Advisory","VDB Entry","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2018:1264","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://access.redhat.com/errata/RHSA-2018:1263","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://snyk.io/vuln/npm:hoek:20180212","tags":["x_refsource_MISC","x_transferred","Exploit","Patch","Third Party Advisory","fix","web","report"]},{"url":"https://nodesecurity.io/advisories/566","tags":["x_refsource_CONFIRM","x_transferred","Broken Link","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2018-3728","tags":["advisory"]},{"url":"https://github.com/hapijs/hoek/commit/5aed1a8c4a3d55722d1c799f2368857bf418d6df","tags":["web"]},{"url":"https://web.archive.org/web/20200227131737/https://www.securityfocus.com/bid/103108","tags":["web"]},{"url":"https://github.com/advisories/GHSA-jp4x-w63m-7wgm"},{"url":"https://security-tracker.debian.org/tracker/CVE-2018-3728","tags":["advisory"]},{"url":"https://github.com/hapijs/hoek","tags":["package"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1493989","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1545893","tags":["report"]},{"url":"https://issues.redhat.com/browse/RHMAP-19902","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2018/rhsa-2018_1263.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2017-15010","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2017-15010","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2017-15010","tags":["advisory"]},{"url":"https://nodesecurity.io/advisories/525","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2018-3728","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2018-3728","tags":["advisory","report"]},{"url":"https://ubuntu.com/security/CVE-2018-3728","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2018-3728","description":"hoek node module before 4.2.0 and 5.0.x before 5.0.3 suffers from a Modification of Assumed-Immutable Data (MAID) vulnerability via 'merge' and 'applyToDefaults' functions, which allows a malicious user to modify the prototype of \"Object\" via __proto__, causing the addition or modification of an existing property that will exist on all objects.","status":"published","published":"2018-03-30T19:00:00Z","modified":"2024-08-05T04:50:30.655Z","cwes":["CWE-471"],"updated_at":"2026-11-02T14:35:05.262903Z"}],"euvd":[{"id":"EUVD-2018-0190","description":"hoek node module before 4.2.0 and 5.0.x before 5.0.3 suffers from a Modification of Assumed-Immutable Data (MAID) vulnerability via 'merge' and 'applyToDefaults' functions, which allows a malicious user to modify the prototype of \"Object\" via __proto__, causing the addition or modification of an existing property that will exist on all objects.","status":"published","published":"2018-03-30T19:00:00Z","modified":"2024-08-05T04:50:30Z","updated_at":"2026-11-03T02:40:15.759349Z"}],"ghsa":[{"id":"GHSA-jp4x-w63m-7wgm","title":"Prototype Pollution in hoek","description":"Versions of `hoek` prior to 4.2.1 and 5.0.3 are vulnerable to prototype pollution.\n\nThe `merge` function, and the `applyToDefaults` and `applyToDefaultsWithShallow` functions which leverage `merge` behind the scenes, are vulnerable to a prototype pollution attack when provided an _unvalidated_ payload created from a JSON string containing the `__proto__` property.\n\nThis can be demonstrated like so:\n\n```javascript\nvar Hoek = require('hoek');\nvar malicious_payload = '{\"__proto__\":{\"oops\":\"It works !\"}}';\n\nvar a = {};\nconsole.log(\"Before : \" + a.oops);\nHoek.merge({}, JSON.parse(malicious_payload));\nconsole.log(\"After : \" + a.oops);\n```\n\nThis type of attack can be used to overwrite existing properties causing a potential denial of service.\n\n\n## Recommendation\n\nUpdate to version 4.2.1, 5.0.3 or later.","status":"published","published":"2018-04-26T15:25:17Z","modified":"2025-05-29T22:49:50Z","cvss":[{"version":"3.0","score":8.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-1321"],"updated_at":"2026-11-02T14:38:45.948817Z"}],"nvd":[{"id":"CVE-2018-3728","description":"hoek node module before 4.2.0 and 5.0.x before 5.0.3 suffers from a Modification of Assumed-Immutable Data (MAID) vulnerability via 'merge' and 'applyToDefaults' functions, which allows a malicious user to modify the prototype of \"Object\" via __proto__, causing the addition or modification of an existing property that will exist on all objects.","status":"published","published":"2018-03-30T19:29:00.21Z","modified":"2026-06-17T01:57:44.063Z","cvss":[{"version":"3.0","score":8.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":6.5,"vector":"AV:N/AC:L/Au:S/C:P/I:P/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-471"],"updated_at":"2026-11-02T14:04:24.700429Z"}],"osv":[{"id":"CVE-2018-3728","description":"hoek node module before 4.2.0 and 5.0.x before 5.0.3 suffers from a Modification of Assumed-Immutable Data (MAID) vulnerability via 'merge' and 'applyToDefaults' functions, which allows a malicious user to modify the prototype of \"Object\" via __proto__, causing the addition or modification of an existing property that will exist on all objects.","status":"published","published":"2018-03-30T19:29:00.21Z","modified":"2026-10-20T10:50:27.724856249Z","cvss":[{"version":"3.0","score":8.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:09.442568Z"},{"id":"DEBIAN-CVE-2018-3728","description":"hoek node module before 4.2.0 and 5.0.x before 5.0.3 suffers from a Modification of Assumed-Immutable Data (MAID) vulnerability via 'merge' and 'applyToDefaults' functions, which allows a malicious user to modify the prototype of \"Object\" via __proto__, causing the addition or modification of an existing property that will exist on all objects.","status":"published","published":"2018-03-30T19:29:00.21Z","modified":"2026-10-23T18:03:57.400059802Z","cvss":[{"version":"3.0","score":8.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:30.867575Z"},{"id":"GHSA-jp4x-w63m-7wgm","title":"Prototype Pollution in hoek","description":"Versions of `hoek` prior to 4.2.1 and 5.0.3 are vulnerable to prototype pollution.\n\nThe `merge` function, and the `applyToDefaults` and `applyToDefaultsWithShallow` functions which leverage `merge` behind the scenes, are vulnerable to a prototype pollution attack when provided an _unvalidated_ payload created from a JSON string containing the `__proto__` property.\n\nThis can be demonstrated like so:\n\n```javascript\nvar Hoek = require('hoek');\nvar malicious_payload = '{\"__proto__\":{\"oops\":\"It works !\"}}';\n\nvar a = {};\nconsole.log(\"Before : \" + a.oops);\nHoek.merge({}, JSON.parse(malicious_payload));\nconsole.log(\"After : \" + a.oops);\n```\n\nThis type of attack can be used to overwrite existing properties causing a potential denial of service.\n\n\n## Recommendation\n\nUpdate to version 4.2.1, 5.0.3 or later.","status":"published","published":"2018-04-26T15:25:17Z","modified":"2025-05-29T22:49:49Z","cvss":[{"version":"3.0","score":8.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-1321"],"updated_at":"2026-11-02T15:46:50.687609Z"},{"id":"RHSA-2018:1263","title":"Red Hat Security Advisory: Red Hat Mobile Application Platform 4.6.0 release - RPMs","status":"published","published":"2024-09-14T00:39:21Z","modified":"2026-06-29T10:20:01Z","cvss":[{"version":"3.0","score":5.3,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"updated_at":"2026-11-02T15:53:04.822845Z"},{"id":"ROOT-APP-NPM-CVE-2018-3728","title":"CVE-2018-3728 in hoek - Patched by Root","description":"Root has patched CVE-2018-3728 in the hoek package for Root:npm. Multiple fixed versions available.","status":"published","published":"2026-11-06T11:03:06Z","modified":"2026-11-06T12:15:02.634106433Z","cvss":[{"version":"3.0","score":8.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-06T12:43:08.762989Z"},{"id":"UBUNTU-CVE-2018-3728","description":"hoek node module before 4.2.0 and 5.0.x before 5.0.3 suffers from a Modification of Assumed-Immutable Data (MAID) vulnerability via 'merge' and 'applyToDefaults' functions, which allows a malicious user to modify the prototype of \"Object\" via __proto__, causing the addition or modification of an existing property that will exist on all objects.","status":"published","published":"2018-03-30T19:29:00Z","modified":"2026-10-17T12:55:26.691579302Z","cvss":[{"version":"3.0","score":8.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:54:18.33562Z"},{"id":"CLSA-2026-1772583211","title":"TuxCare security update for hoek (2 CVEs)","description":"TuxCare rebuilt hoek to address 2 CVEs. Fixed in 2.16.3-tuxcare.1.","status":"published","published":"2026-08-04T14:52:10Z","modified":"2026-10-15T09:45:26.071914192Z","updated_at":"2026-11-02T15:43:43.249928Z"},{"id":"CLSA-2026-1773015267","title":"TuxCare security update for hoek (2 CVEs)","description":"TuxCare rebuilt hoek to address 2 CVEs. Fixed in 2.11.1-tuxcare.1.","status":"published","published":"2026-08-04T14:52:11Z","modified":"2026-10-15T09:45:26.475113266Z","updated_at":"2026-11-02T15:43:43.249928Z"},{"id":"CLSA-2026-1773274552","title":"TuxCare security update for hoek (2 CVEs)","description":"TuxCare rebuilt hoek to address 2 CVEs. Fixed in 2.14.0-tuxcare.1.","status":"published","published":"2026-08-04T14:52:12Z","modified":"2026-10-15T09:47:28.361210481Z","updated_at":"2026-11-02T15:43:43.621843Z"},{"id":"CLSA-2026-1773274559","title":"TuxCare security update for hoek (2 CVEs)","description":"TuxCare rebuilt hoek to address 2 CVEs. Fixed in 2.12.0-tuxcare.1.","status":"published","published":"2026-08-04T14:52:12Z","modified":"2026-10-15T09:47:28.499087847Z","updated_at":"2026-11-02T15:43:43.621843Z"},{"id":"CLSA-2026-1774743819","title":"TuxCare security update for hoek (2 CVEs)","description":"TuxCare rebuilt hoek to address 2 CVEs. Fixed in 0.8.5-tuxcare.1.","status":"published","published":"2026-08-04T14:52:15Z","modified":"2026-10-15T09:47:48.671122272Z","updated_at":"2026-11-02T15:43:43.621843Z"},{"id":"CLSA-2026-1774743820","title":"TuxCare security update for hoek (2 CVEs)","description":"TuxCare rebuilt hoek to address 2 CVEs. Fixed in 0.9.1-tuxcare.1.","status":"published","published":"2026-08-04T14:52:15Z","modified":"2026-10-15T09:47:48.603854025Z","updated_at":"2026-11-02T15:43:43.621843Z"}]}}