Prototype pollution in HedgeDoc - #VU165816
Published: November 11, 2026
Vulnerability identifier: #VU165816
CSH Severity: Low
CVSS v4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: N/A
CWE-ID: CWE-1321
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to cause a denial of service by crashing the HedgeDoc server.
The vulnerability exists due to prototype pollution in the historyPost function in lib/history.js when processing note-history updates using an existence check that accepts inherited properties. A remote user can submit a history update with the note alias __proto__ to modify the pinned property on Object.prototype, causing an HTTP 500 response and subsequent requests to crash the Node.js process.
Affected software
HedgeDoc
Remediation
Install security update from vendor's website.
HedgeDoc - update to 1.12.1