GHSA-g64q-3vg8-8f93: 
JavaScript vulnerability analysis and mitigation

A high-severity Prototype Pollution vulnerability was identified in the npm package 'subtext' (GHSA-g64q-3vg8-8f93). The vulnerability affects all versions of the package, with no patched versions available. The issue was published to the GitHub Advisory Database on September 3, 2020, and last updated on January 9, 2023. The package has since been deprecated (GitHub Advisory).

The vulnerability allows for Prototype Pollution through multipart payload manipulation. Specifically, attackers can construct a multipart payload where one of the parts' content can be set as the entire payload object's prototype. The vulnerability is classified under CWE-1321 and has been assessed as having High severity (GitHub Advisory).

The vulnerability can lead to two primary impacts: First, if the injected prototype contains data, it may bypass validation rules that enforce access and privacy controls. Second, if the prototype evaluates to null, it can trigger unhandled exceptions when the request payload is accessed (GitHub Advisory).

The vulnerability exists in all versions of the subtext package (>= 0.0.0), with no patched versions available in the original package (GitHub Advisory).

As the package is deprecated, the recommended mitigation is to update dependencies to use '@hapi/subtext', which is the maintained version of the package (GitHub Advisory).