CVE-2018-3728 is a high-severity (CVSS 8.8) CWE-471 vulnerability in hoek. 2 public exploit or proof-of-concept references are indexed, so weaponization risk is real. A fix is available for hoek — see the affected versions and patch details below.
Prototype Pollution in hoek
EPSS Exploitation Probability
Probability of exploitation in the next 30 days, from FIRST.org EPSS.
How urgent is this, really
Where this sits among everything scored
Real-World Exposure
How broadly this vulnerability is actually deployed: weekly install volume shows current usage, a proxy for how much of the ecosystem is exposed.
hoeknpmDescription
Versions of hoek prior to 4.2.1 and 5.0.3 are vulnerable to prototype pollution.
The merge function, and the applyToDefaults and applyToDefaultsWithShallow functions which leverage merge behind the scenes, are vulnerable to a prototype pollution attack when provided an unvalidated payload created from a JSON string containing the __proto__ property.
This can be demonstrated like so:
var Hoek = require('hoek');
var malicious_payload = '{"__proto__":{"oops":"It works !"}}';
var a = {};
console.log("Before : " + a.oops);
Hoek.merge({}, JSON.parse(malicious_payload));
console.log("After : " + a.oops);
This type of attack can be used to overwrite existing properties causing a potential denial of service.
Recommendation
Update to version 4.2.1, 5.0.3 or later.
Affected Packages
| Ecosystem | Package | Vulnerable range | Fix |
|---|---|---|---|
| 📦npm | hoek | ≥ 5.0.0&&< 5.0.3 | 5.0.3npm install hoek@5.0.3 |
| 📦npm | hoek | all versions | 4.2.1npm install hoek@4.2.1 |
Affected Products
hoekhapijsResearch use only. For defensive security, authorized penetration testing, and academic research only. Never execute exploit code against systems without explicit written authorization.
Detection & mitigation playbook
Open-source dependencyDetect
Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for hoek, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.
Fix
Update hoek to 5.0.3 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms CVE-2018-3728 is resolved across your whole dependency graph.
Workarounds
Cap what an attacker can consume: apply request size, rate and timeout limits in front of the affected component, and run it with memory and CPU limits so exhaustion degrades one worker rather than the whole service.
Fixing This On Your OS
If you run this on a Linux distribution, patch through your package manager against the distro's own security advisory below — it tracks the exact backported fix for your release, which can ship on a different timeline (and sometimes a different severity) than the upstream project.
Red Hat Quay includes hoek as a dependency of protractor which is only used at build time. The vulnerable library is not used at runtime meaning this has a low impact on Red Hat Quay.
| Product | Fixed in | Advisory |
|---|---|---|
| Red Hat Mobile Application Platform 4.6 | fh-system-dump-tool-0:1.0.0-5.el7 | RHSA-2018:1263 |
| Red Hat Mobile Application Platform 4.6 | rhmap46/fh-aaa:1.1.3-4 | RHSA-2018:1264 |
| Red Hat Quay 3 | quay/quay-rhel8:v3.6.0-62 | RHSA-2021:3917 |
Frequently Asked Questions
Is CVE-2018-3728 in your dependencies?
Find it across npm, including transitive dependencies.