AIKIDO-2026-963596

TL;DR

@noble/hashes funnels caller-supplied options through a shared checkOpts helper that, before 2.4.0, merged them with const merged = Object.assign(defaults, opts) and no __proto__ guard. Because Object.assign performs a [[Set]], an opts object carrying an own __proto__ data property (for example one produced by JSON.parse of untrusted input) redirects the prototype of the internal merged-options object, so inherited properties are read back as cryptographic option values such as a forged dkLen, key, salt, or personalization. Merging onto the plain-object defaults also meant omitted fields resolved against Object.prototype, so any ambient prototype pollution could feed forged option values into hashing, MAC, and key-derivation calls. The fix rejects own __proto__ option keys and builds the merged options on a null-prototype object (Object.create(null)).