Hey API's openapi-ts package versions before 0.97.3 contain a prototype pollution vulnerability (CWE-1321) in the buildClientParams function. This function writes unknown slot-prefixed keys (e.g., $query_) directly to parameter objects, permitting an attacker to supply a key like $query___proto__ that sets params.query.__proto__ to an attacker-controlled value. This manipulation exposes inherited attacker-controlled keys during for..in iteration, potentially affecting application behavior relying on these parameters. The vulnerability is resolved in version 0.97.3.

An attacker can modify the prototype of parameter objects, causing inherited properties to be attacker-controlled. This may lead to unexpected behavior in applications using the affected SDKs, including potential information disclosure or logic manipulation. The CVSS score of 4.8 reflects a medium impact with low confidentiality and integrity impact and no availability impact.

Upgrade to hey-api openapi-ts version 0.97.3 or later, where this prototype pollution vulnerability is fixed. No other mitigation or temporary workaround is documented. Patch status is not explicitly stated but the vendor has fixed the issue in 0.97.3, so updating to this version or newer is the recommended remediation.