CVE-2019-10746
Prototype Pollution in mixin-deep
mixin-deep is vulnerable to Prototype Pollution in versions before 1.3.2 and version 2.0.0. The function mixin-deep could be tricked into adding or modifying properties of Object.prototype using a constructor payload.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
mixin-deep is vulnerable to Prototype Pollution in versions before 1.3.2 and version 2.0.0. The function mixin-deep could be tricked into adding or modifying properties of Object.prototype using a constructor payload.
- Record
CVE-2019-10746- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - CVSS 2.0
- 7.5 High
AV:N/AC:L/Au:N/C:P/I:P/A:P - Weakness
- CWE-88
- Updated
- 2026-11-02
CVE List No score
mixin-deep is vulnerable to Prototype Pollution in versions before 1.3.2 and version 2.0.0. The function mixin-deep could be tricked into adding or modifying properties of Object.prototype using a constructor payload.
- Record
CVE-2019-10746- Updated
- 2026-11-02
EUVDEUVD-2019-0632 No score
mixin-deep is vulnerable to Prototype Pollution in versions before 1.3.2 and version 2.0.0. The function mixin-deep could be tricked into adding or modifying properties of Object.prototype using a constructor payload.
- Record
EUVD-2019-0632- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-fhjf-83wg-r2j9
Prototype Pollution in mixin-deep
Versions of mixin-deep prior to 2.0.1 or 1.3.2 are vulnerable to Prototype Pollution. The mixinDeep function fails to validate which Object properties it updates. This allows attackers to modify the prototype of Object, causing the addition or modification of an existing property on all objects.
Recommendation
If you are using mixin-deep 2.x, upgrade to version 2.0.1 or later.
If you are using mixin-deep 1.x, upgrade to version 1.3.2 or later.
- Record
GHSA-fhjf-83wg-r2j9- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-88
- Updated
- 2026-11-02
OSV
mixin-deep is vulnerable to Prototype Pollution in versions before 1.3.2 and version 2.0.0. The function mixin-deep could be tricked into adding or modifying properties of Object.prototype using a constructor payload.
- Record
CVE-2019-10746- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVDEBIAN-CVE-2019-10746
mixin-deep is vulnerable to Prototype Pollution in versions before 1.3.2 and version 2.0.0. The function mixin-deep could be tricked into adding or modifying properties of Object.prototype using a constructor payload.
- Record
DEBIAN-CVE-2019-10746- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
Show 6 moreShow less
OSVGHSA-fhjf-83wg-r2j9
Prototype Pollution in mixin-deep
Versions of mixin-deep prior to 2.0.1 or 1.3.2 are vulnerable to Prototype Pollution. The mixinDeep function fails to validate which Object properties it updates. This allows attackers to modify the prototype of Object, causing the addition or modification of an existing property on all objects.
Recommendation
If you are using mixin-deep 2.x, upgrade to version 2.0.1 or later.
If you are using mixin-deep 1.x, upgrade to version 1.3.2 or later.
- Record
GHSA-fhjf-83wg-r2j9- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-88
- Updated
- 2026-11-02
OSVRHSA-2021:0485
Red Hat Security Advisory: rh-nodejs12-nodejs security update
- Record
RHSA-2021:0485- CVSS 3.1
- 8.1 High
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVRHSA-2021:0549
Red Hat Security Advisory: nodejs:12 security update
- Record
RHSA-2021:0549- CVSS 3.1
- 8.1 High
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVRLSA-2021:0549
Moderate: nodejs:12 security update
Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.
The following packages have been upgraded to a later upstream version: nodejs (12.20.1), nodejs-nodemon (2.0.3).
Security Fix(es):
-
nodejs-mixin-deep: prototype pollution in function mixin-deep (CVE-2019-10746)
-
nodejs-set-value: prototype pollution in function set-value (CVE-2019-10747)
-
nodejs-npm-user-validate: improper input validation when validating user emails leads to ReDoS (CVE-2020-7754)
-
nodejs-ini: prototype pollution via malicious INI file (CVE-2020-7788)
-
nodejs: use-after-free in the TLS implementation (CVE-2020-8265)
-
nodejs: HTTP request smuggling via two copies of a header field in an http request (CVE-2020-8287)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
- Record
RLSA-2021:0549- CVSS 3.1
- 8.1 High
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVUBUNTU-CVE-2019-10746
mixin-deep is vulnerable to Prototype Pollution in versions before 1.3.2 and version 2.0.0. The function mixin-deep could be tricked into adding or modifying properties of Object.prototype using a constructor payload.
- Record
UBUNTU-CVE-2019-10746- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVALSA-2021:0549 No score
Moderate: nodejs:12 security update
Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.
The following packages have been upgraded to a later upstream version: nodejs (12.20.1), nodejs-nodemon (2.0.3).
Security Fix(es):
-
nodejs-mixin-deep: prototype pollution in function mixin-deep (CVE-2019-10746)
-
nodejs-set-value: prototype pollution in function set-value (CVE-2019-10747)
-
nodejs-npm-user-validate: improper input validation when validating user emails leads to ReDoS (CVE-2020-7754)
-
nodejs-ini: prototype pollution via malicious INI file (CVE-2020-7788)
-
nodejs: use-after-free in the TLS implementation (CVE-2020-8265)
-
nodejs: HTTP request smuggling via two copies of a header field in an http request (CVE-2020-8287)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
- Record
ALSA-2021:0549- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
mixin-deepnpm |
before 1.3.2 | 1.3.2 |
mixin-deepnpm |
2.0.0 to 2.0.0 | 2.0.1 |
nodejs-nodemonAlmaLinux:8 From an advisory covering 7 CVEs |
before 2.0.3-1.module_el8.4.0+2521+c668cc9f | 2.0.3-1.module_el8.4.0+2521+c668cc9f |
nodejs-packagingAlmaLinux:8 From an advisory covering 7 CVEs |
before 17-3.module_el8.4.0+2224+b07ac28e | 17-3.module_el8.4.0+2224+b07ac28e |
nodejs-packagingAlmaLinux:8 From an advisory covering 7 CVEs |
before 17-3.module_el8.4.0+2521+c668cc9f | 17-3.module_el8.4.0+2521+c668cc9f |
nodejs-packagingAlmaLinux:8 From an advisory covering 7 CVEs |
before 17-3.module_el8.3.0+2023+d2377ea3 | 17-3.module_el8.3.0+2023+d2377ea3 |
node-mixin-deepDebian:12 |
before 2.0.1-1 | 2.0.1-1 |
node-mixin-deepDebian:13 |
before 2.0.1-1 | 2.0.1-1 |
node-mixin-deepDebian:14 |
before 2.0.1-1 | 2.0.1-1 |
mixin-deepnpm |
2.0.0 up to 2.0.1 | 2.0.1 |
Show 20 moreShow less
| Package | Affected | Fixed |
|---|---|---|
rh-nodejs12-nodejsRed Hat:rhel_software_collections:3::el7 From an advisory covering 7 CVEs |
before 0:12.20.1-1.el7 | 0:12.20.1-1.el7 |
rh-nodejs12-nodejs-debuginfoRed Hat:rhel_software_collections:3::el7 From an advisory covering 7 CVEs |
before 0:12.20.1-1.el7 | 0:12.20.1-1.el7 |
rh-nodejs12-nodejs-develRed Hat:rhel_software_collections:3::el7 From an advisory covering 7 CVEs |
before 0:12.20.1-1.el7 | 0:12.20.1-1.el7 |
rh-nodejs12-nodejs-docsRed Hat:rhel_software_collections:3::el7 From an advisory covering 7 CVEs |
before 0:12.20.1-1.el7 | 0:12.20.1-1.el7 |
rh-nodejs12-nodejs-nodemonRed Hat:rhel_software_collections:3::el7 From an advisory covering 7 CVEs |
before 0:2.0.3-1.el7 | 0:2.0.3-1.el7 |
rh-nodejs12-npmRed Hat:rhel_software_collections:3::el7 From an advisory covering 7 CVEs |
before 0:6.14.10-12.20.1.1.el7 | 0:6.14.10-12.20.1.1.el7 |
nodejsRed Hat:enterprise_linux:8::appstream From an advisory covering 7 CVEs |
before 1:12.20.1-1.module+el8.3.0+9503+19cb079c | 1:12.20.1-1.module+el8.3.0+9503+19cb079c |
nodejs-debuginfoRed Hat:enterprise_linux:8::appstream From an advisory covering 7 CVEs |
before 1:12.20.1-1.module+el8.3.0+9503+19cb079c | 1:12.20.1-1.module+el8.3.0+9503+19cb079c |
nodejs-debugsourceRed Hat:enterprise_linux:8::appstream From an advisory covering 7 CVEs |
before 1:12.20.1-1.module+el8.3.0+9503+19cb079c | 1:12.20.1-1.module+el8.3.0+9503+19cb079c |
nodejs-develRed Hat:enterprise_linux:8::appstream From an advisory covering 7 CVEs |
before 1:12.20.1-1.module+el8.3.0+9503+19cb079c | 1:12.20.1-1.module+el8.3.0+9503+19cb079c |
nodejs-docsRed Hat:enterprise_linux:8::appstream From an advisory covering 7 CVEs |
before 1:12.20.1-1.module+el8.3.0+9503+19cb079c | 1:12.20.1-1.module+el8.3.0+9503+19cb079c |
nodejs-full-i18nRed Hat:enterprise_linux:8::appstream From an advisory covering 7 CVEs |
before 1:12.20.1-1.module+el8.3.0+9503+19cb079c | 1:12.20.1-1.module+el8.3.0+9503+19cb079c |
nodejs-nodemonRed Hat:enterprise_linux:8::appstream From an advisory covering 7 CVEs |
before 0:2.0.3-1.module+el8.3.0+9715+1718613f | 0:2.0.3-1.module+el8.3.0+9715+1718613f |
nodejs-packagingRed Hat:enterprise_linux:8::appstream From an advisory covering 7 CVEs |
before 0:17-3.module+el8.1.0+3369+37ae6a45 | 0:17-3.module+el8.1.0+3369+37ae6a45 |
npmRed Hat:enterprise_linux:8::appstream From an advisory covering 7 CVEs |
before 1:6.14.10-1.12.20.1.1.module+el8.3.0+9503+19cb079c | 1:6.14.10-1.12.20.1.1.module+el8.3.0+9503+19cb079c |
nodejs-nodemonRocky Linux:8 From an advisory covering 7 CVEs |
before 0:2.0.3-1.module+el8.6.0+982+9fdca2d4 | 0:2.0.3-1.module+el8.6.0+982+9fdca2d4 |
nodejs-nodemonRocky Linux:8 From an advisory covering 7 CVEs |
before 0:2.0.3-1.module+el8.3.0+100+234774f7 | 0:2.0.3-1.module+el8.3.0+100+234774f7 |
nodejs-nodemonRocky Linux:8 From an advisory covering 7 CVEs |
before 0:2.0.3-1.module+el8.4.0+638+5344c6f7 | 0:2.0.3-1.module+el8.4.0+638+5344c6f7 |
nodejs-packagingRocky Linux:8 From an advisory covering 7 CVEs |
before 0:17-3.module+el8.3.0+101+f84c7154 | 0:17-3.module+el8.3.0+101+f84c7154 |
node-mixin-deepUbuntu:18.04:LTS |
All versions, plus listed versions 1.1.3-1 |
None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2019-10746 is a critical vulnerability (CVSS 9.8) in Mixin-deep Project Mixin-deep, published August 23, 2019. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 3.65%, the 89th percentile. Fixed in mixin-deep 1.3.2.
References
lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UXRA365KZCUNXMU3KDH5JN5BEPNIGUKC
oracle.com//security-alerts/cpujul2021.html
snyk.io/vuln/SNYK-JS-MIXINDEEP-450212
nvd.nist.gov/vuln/detail/CVE-2019-10746
Show 53 moreShow less
npmjs.com/advisories/1013
github.com/jonschlinkert/mixin-deep/commit/8f464c8ce9761a8c9c2b3457eaeee9d404fa7af9
errata.almalinux.org/8/ALSA-2021-0549.html
vulners.com/cve/CVE-2018-3750
security-tracker.debian.org/tracker/CVE-2019-10746
access.redhat.com/errata/RHSA-2021:0485
bugzilla.redhat.com/show_bug.cgi?id=1795475
security.access.redhat.com/data/csaf/v2/advisories/2021/rhsa-2021_0485.json
cve.org/CVERecord?id=CVE-2018-3750
hackerone.com/reports/311333
nodesecurity.io/advisories/612
errata.rockylinux.org/RLSA-2021:0549
ubuntu.com/security/CVE-2019-10746