Description
hoek node module before 4.2.0 and 5.0.x before 5.0.3 suffers from a Modification of Assumed-Immutable Data (MAID) vulnerability via 'merge' and 'applyToDefaults' functions, which allows a malicious user to modify the prototype of "Object" via __proto__, causing the addition or modification of an existing property that will exist on all objects.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| hapi | hoek node module | Versions before 5.0.3 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | node-hoek | 5.0.3-1 | — |
| Debian 13 | node-hoek | 5.0.3-1 | — |
| Debian 12 | node-hoek | 5.0.3-1 | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.10 | node-hoek | No fix yet | — |
| Ubuntu 26.04 LTS | node-hoek | No fix yet | — |
| Ubuntu 25.10 | node-hoek | No fix yet | — |
| Ubuntu 24.04 LTS | node-hoek | No fix yet | — |
| Ubuntu 22.04 LTS | node-hoek | No fix yet | — |
Show 2 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 20.04 LTS | node-hoek | No fix yet | — |
| Ubuntu 18.04 LTS | node-hoek | No fix yet | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Mobile Application Platform 4 | fh-system-dump-tool | 1.0.0-5.el7 | RHSA-2018:1263 |
| Red Hat Mobile Application Platform 4 | fping | 3.10-4.el7map | RHSA-2018:1263 |
| Red Hat Mobile Application Platform 4 | nagios +2 | 4.0.8-8.el7map | RHSA-2018:1263 |
| Red Hat Mobile Application Platform 4 | nagios-plugins +55 | 2.0.3-3.el7map | RHSA-2018:1263 |
| Red Hat Mobile Application Platform 4 | perl-Crypt-CBC | 2.33-2.el7map | RHSA-2018:1263 |
| Red Hat Mobile Application Platform 4 | perl-Crypt-DES | 2.05-20.el7map | RHSA-2018:1263 |
| Red Hat Mobile Application Platform 4 | perl-Net-SNMP | 6.0.1-7.el7map | RHSA-2018:1263 |
| Red Hat Mobile Application Platform 4 | phantomjs | 1.9.7-3.el7map | RHSA-2018:1263 |
| Red Hat Mobile Application Platform 4 | python-meld3 | 0.6.10-1.el7map | RHSA-2018:1263 |
| Red Hat Mobile Application Platform 4 | qstat | 2.11-13.20080912svn311.el7map | RHSA-2018:1263 |
| Red Hat Mobile Application Platform 4 | radiusclient-ng +2 | 0.5.6-9.el7map | RHSA-2018:1263 |
| Red Hat Mobile Application Platform 4 | redis | 2.8.21-2.el7map | RHSA-2018:1263 |
| Red Hat Mobile Application Platform 4 | rhmap-fh-openshift-templates | 4.6.0-5.el7 | RHSA-2018:1263 |
| Red Hat Mobile Application Platform 4 | rhmap-mod_authnz_external | 3.3.1-7.el7map | RHSA-2018:1263 |
| Red Hat Mobile Application Platform 4 | sendEmail | 1.56-2.el7 | RHSA-2018:1263 |
| Red Hat Mobile Application Platform 4 | ssmtp | 2.64-14.el7map | RHSA-2018:1263 |
| Red Hat Mobile Application Platform 4 | supervisor | 3.1.3-3.el7map | RHSA-2018:1263 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| npm | hoek | >= 5.0.0, < 5.0.3 | 5.0.3 | GHSA-jp4x-w63m-7wgm |
| npm | hoek | < 4.2.1 | 4.2.1 | GHSA-jp4x-w63m-7wgm |
Advisories 1
- RHSA-2018:1263 Red Hat Security Advisory: Red Hat Mobile Application Platform 4.6.0 release - RPMs Red Hat Security Advisories (RHSA) · Jun 29, 2026