CVE-2026-48819 Details
Description
Hey API is an ecosystem for turning API specifications into production-ready code. Prior to 0.97.3, dist/clients/core/params.ts ships a runtime template copied into generated SDKs as params.gen.ts, and buildClientParams writes unknown slot-prefixed keys such as $body_, $headers_, $path_, and $query_ directly to the corresponding slot, allowing $query___proto__ alongside a legitimate q field to set params.query through params["query"]["__proto__"] = value, call Object.setPrototypeOf(params.query, value), and expose inherited attacker-controlled keys during for..in iteration. This issue is fixed in version 0.97.3.
A prototype pollution vulnerability exists in Hey API's OpenAPI client generation package, specifically in versions prior to 0.97.3. The issue arises in the 'dist/clients/core/params.ts' file, which contains a runtime template that is copied into generated SDKs. The vulnerability allows an attacker to manipulate the prototype of objects returned by the 'buildClientParams' function, potentially leading to the exposure of inherited, attacker-controlled properties. This exploitation can occur during 'for..in' iterations, commonly used in routing or authorization checks.
Users can upgrade to '@hey-api/openapi-ts' version 0.97.3 or later, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jul 17, 2026CISA-ADP
Assessed Jul 20, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/hey-api/hey-api/security/advisories/GHSA-hhx9-57xq-r5rw | CISA-ADP | AdvisoryExploitRemedyVendor |
| https://github.com/hey-api/hey-api/commit/023909137a15eff9c0263d3bcd116140076b214f | [email protected] | Source CodeVendor |
| https://github.com/hey-api/hey-api/commit/da321a1529eb3c90d2109da870f514b915a60169 | [email protected] | Source CodeVendor |
| https://github.com/hey-api/hey-api/releases/tag/%40hey-api%2Fopenapi-ts%400.97.3 | [email protected] | Vendor |
| https://github.com/hey-api/hey-api/security/advisories/GHSA-hhx9-57xq-r5rw | [email protected] | AdvisoryExploitRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-1321 | Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| hey-api | < 0.97.3 (semver) |
CPE
Remediation
| |
| @hey-api/openapi-ts | <= 0.97.2 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 20, 2026 | CVE Modified | CISA-ADP |
| Jul 17, 2026 | New CVE Received | [email protected] |