Showing with 14,607 additions and 44 deletions.

+3 −0 CHANGELOG.md

+3 −0 dist/async.js

+1 −1 dist/async.min.js

+1 −1 dist/async.min.map

+3 −0 lib/internal/iterator.js

+11 −0 mocha_test/mapValues.js

+14,584 −41 package-lock.json

+1 −1 package.json
diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -1,3 +1,6 @@
+# v2.6.4
+- Fix potential prototype pollution exploit (#1828)
+
 # v2.6.3
 - Updated lodash to squelch a security warning (#1675)
 

diff --git a/dist/async.js b/dist/async.js
@@ -948,6 +948,9 @@ function createObjectIterator(obj) {
     var len = okeys.length;
     return function next() {
         var key = okeys[++i];
+        if (key === '__proto__') {
+            return next();
+        }
         return i < len ? {value: obj[key], key: key} : null;
     };
 }