CVE-2020-36604: hapijs hoek Prototype Pollution
CVSS: 8.1v3.1HighModified
AliasesUBUNTU-CVE-2020-36604DEBIAN-CVE-2020-36604GHSA-c429-5p7v-vgjpCGA-24c7-5p2f-p5mwCGA-2642-fhg5-rgmfCGA-269g-m55w-9pf4CGA-26jx-cjjq-gmrgCGA-2gv4-28rp-hp2fCGA-2h3r-qpvw-mcf3CGA-2w4c-35rr-ccj6CGA-32qq-qvrm-mc39CGA-35jw-xch7-g79fCGA-3v5j-4mc2-9mf7CGA-4594-85xr-mhrfCGA-45cg-wvvm-g6hvCGA-4w32-4j6h-6qf4CGA-4xg2-49qm-9gvgCGA-53f9-xhjj-27r6CGA-53mq-v969-2389CGA-673c-q467-rmh6CGA-6qhr-6xrh-7vpgCGA-6w27-f985-qmxqCGA-727h-7whf-8cwvCGA-78f3-5hgp-r395CGA-7v93-293g-fwv7CGA-82jc-mgmp-6m8cCGA-8cc3-8hxp-3pw5CGA-8f9f-8hf3-98rjCGA-8gcc-8hrm-hqp4CGA-9wc4-38pc-87hfCGA-c3p6-5cpq-rc3pCGA-c5p6-jp6p-9gmjCGA-cp7r-5fxg-3367CGA-f79g-q96p-h9hfCGA-f7q8-6r98-cffrCGA-fvq5-grg2-wcffCGA-g332-r6mw-855rCGA-g39v-mx68-jq49CGA-g8w4-g895-wvpcCGA-gh26-xmqv-wvq4CGA-gqm9-gxhf-cw39CGA-gx64-fx79-h3mhCGA-hc26-j55x-w4mhCGA-j7rr-p3xr-x7r4CGA-jc4p-pg99-pw58CGA-m3r6-25jp-cr64CGA-m4pc-c7qq-q452CGA-p8mv-fc4h-43m6CGA-pfjc-cp8m-jpphCGA-phw6-rc86-h269CGA-pj9w-794v-w4qfCGA-q86h-wp4r-95vhCGA-qm72-x5rh-3xpqCGA-qxph-47qw-vcmmCGA-r7j8-56w8-x8c6CGA-rqh7-mh9c-cw7vCGA-rrj7-vfpp-f5j9CGA-v4qh-2x9q-86m4CGA-v4wv-w2vr-3rpmCGA-vcx2-qjqr-jrc6CGA-vp7x-9f9p-48c4CGA-w39f-c7h2-hfr6CGA-w8wp-mq3q-phhf
Published 23-09-2022Last modified 27-05-2025
Vulnerability summary
CVE-2020-36604 is a high (CVSS 8.1) Prototype Pollution vulnerability in hapijs hoek. EPSS estimates a 1.24% chance of exploitation in the next 30 days, higher than 68.7% of scored vulnerabilities.
CVSS score
8.1/10
010
High · v3.1 (CVE.org)EPSS score
1.24%
0%100%
Low · +0.21 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded
Advisory lineage
Upstream 0 · Downstream 0 · Related 3Timeline
- 23-09-2022PublishedVulnerability first disclosed.
- 27-05-2025Last modifiedVulnerability information updated.
Description
hoek before 8.5.1 and 9.x before 9.0.3 allows prototype poisoning in the clone function.
CVSS metrics
6 scores · 6 sources · 1 versionHigh 8.1Preferred score · CVE.org (CNA)
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:HSourcesAll 6 agree
- OSV · UbuntuEcosystem advisory · calculated8.1HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
- OSV · DebianEcosystem advisory · calculated8.1HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
- OSV · NpmEcosystem advisory · calculated8.1HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
- OSV · ChainguardEcosystem advisory · calculated8.1HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
- NVDNIST8.1HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS trend
Probability
1.24%
Chance of exploitation in the next 30 days
Percentile
69%
Versus all other CVEs
30-day change
+0.21 pp
From 1.03% on 19-09-2026
19-09-202619-10-2026
EPSS score1.24%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Chainguard30 products
- opensearch-dashboards-2< 2.11.1-r2
- opensearch-dashboards-2-alerting-dashboards-plugin< 2.11.1-r2
- opensearch-dashboards-2-anomaly-detection-dashboards-plugin< 2.11.1-r2
- opensearch-dashboards-2-config< 2.11.1-r2
- opensearch-dashboards-2-dashboards-maps< 2.11.1-r2
@hapi1 product
- hoek< 8.5.1 | ≥ 9.0.0, < 9.0.3
Debian1 product
- node-hoek< 9.0.3+~5.0.0+~4.0.0-1
Hapijs1 product
- hoek< 8.5.1 | ≥ 9.0, < 9.0.3
Npm1 product
- hoek≤ 6.1.3
Ubuntu1 product
- node-hoekAll versions (No fix recorded)
6 vendors · 35 products
