hey-api openapi-ts up to 0.97.2 Parameter Slot params.ts buildClientParams body_/headers_/path_/query_ iteration

Summaryinfo

A vulnerability, which was classified as problematic, was found in hey-api openapi-ts up to 0.97.2. This affects the function buildClientParams of the file dist/clients/core/params.ts of the component Parameter Slot Handler. Executing a manipulation of the argument body_/headers_/path_/query_ can lead to iteration. This vulnerability appears as CVE-2026-48819. The attack requires local access. There is no available exploit.

Detailsinfo

A vulnerability has been found in hey-api openapi-ts up to 0.97.2 and classified as problematic. This vulnerability affects the function buildClientParams of the file dist/clients/core/params.ts of the component Parameter Slot Handler. The manipulation of the argument body_/headers_/path_/query_ with an unknown input leads to a iteration vulnerability. The CWE definition for the vulnerability is CWE-834. The product performs an iteration or loop without sufficiently limiting the number of times that the loop is executed. As an impact it is known to affect confidentiality, integrity, and availability. CVE summarizes:

Hey API is an ecosystem for turning API specifications into production-ready code. Prior to 0.97.3, dist/clients/core/params.ts ships a runtime template copied into generated SDKs as params.gen.ts, and buildClientParams writes unknown slot-prefixed keys such as $body_, $headers_, $path_, and $query_ directly to the corresponding slot, allowing $query___proto__ alongside a legitimate q field to set params.query through params["query"]["__proto__"] = value, call Object.setPrototypeOf(params.query, value), and expose inherited attacker-controlled keys during for..in iteration. This issue is fixed in version 0.97.3.

The advisory is shared for download at github.com. This vulnerability was named CVE-2026-48819 since 05/22/2026. The exploitation appears to be easy. The attack needs to be approached locally. Successful exploitation requires user interaction by the victim. There are known technical details, but no exploit is available.

Upgrading to version 0.97.3 eliminates this vulnerability.

Once again VulDB remains the best source for vulnerability data.

Productinfo

Type

• Automation Software

Vendor

• hey-api

Name

• openapi-ts

Version

• 0.97.0
• 0.97.1
• 0.97.2

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion