clarkie / dynogels

DynamoDB data mapper for node.js. Originally forked from https://github.com/ryanfitz/vogels
Other
491 stars 110 forks source link

fix: Fixing the hoek and lodash module vulnerabilities #203

Closed eakraml closed 3 years ago

eakraml commented 3 years ago

The hoek module for Node is vulnerable to prototype pollution. An attacker could exploit this vulnerability to modify the Object prototype which causes additional properties or changes to exist on all objects. It is used by an old joi module version. The related dependencies are now updated and the tests have been adapted because the format of Joi related objects changed.