Is there an existing issue for this?

• I have searched the existing issues

Current behavior

Snyk has recently flagged a high severity vuln in the lodash.set dependency. Here is Snyk's security bulletin:
https://security.snyk.io/vuln/SNYK-JS-LODASHSET-1320032

The original HackerOne report (https://hackerone.com/reports/864701), seems to indicate that the vulnerability was patched in the main lodash package. However it seems that the lodash.set package hasn't been updated in 5 years so it doesn't have the patch.

It may be a good idea change @nestjs/config to rely on the full lodash package or use some other package. This page indicates that the per-method packages are a thing of the past and won't be maintained: https://lodash.com/per-method-packages

Minimum reproduction code

https://github.com/shaunek/nestjs-config-lodash.set-vuln

Steps to reproduce

• Clone demo repo https://github.com/shaunek/nestjs-config-lodash.set-vuln
• Install dependecies with npm install
  • Note that the only dependency is the @nestjs/config package
• Run index.js with node index.js

Results show that the lodash.set package contains the Prototype Pollution vulnerability

Expected behavior

When the javascript code set({}, "__proto__[test]", "456"); is called it should not pollute the Object.prototype

Package version

1.1.5

NestJS version

n/a

Node.js version

v16.13.1

In which operating systems have you tested?

• macOS
• Windows
• Linux

Other

No response