Every CVE Search/ Get API key

CVE-2018-3750

Prototype Pollution in deep-extend

9.8 CriticalFix available

The utilities function in all versions <= 0.5.0 of the deep-extend node module can be tricked into modifying the prototype of Object when the attacker can control part of the structure passed to this function. This can let an attacker add or modify existing properties that will exist on all objects.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
High
Integrity
High
Availability
High

Exploit likelihood

2.15%Up 1.7 points since Apr 14, 2021
90%50%10%1%

What each source reports

NVD Score used 9.8

The utilities function in all versions <= 0.5.0 of the deep-extend node module can be tricked into modifying the prototype of Object when the attacker can control part of the structure passed to this function. This can let an attacker add or modify existing properties that will exist on all objects.

Record
CVE-2018-3750
CVSS 3.0
9.8 CriticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS 2.0
7.5 HighAV:N/AC:L/Au:N/C:P/I:P/A:P
Weakness
CWE-20
Updated
2026-11-02
CVE List No score

The utilities function in all versions <= 0.5.0 of the deep-extend node module can be tricked into modifying the prototype of Object when the attacker can control part of the structure passed to this function. This can let an attacker add or modify existing properties that will exist on all objects.

Record
CVE-2018-3750
Updated
2026-11-02
EUVDEUVD-2018-0617 No score

The utilities function in all versions <= 0.5.0 of the deep-extend node module can be tricked into modifying the prototype of Object when the attacker can control part of the structure passed to this function. This can let an attacker add or modify existing properties that will exist on all objects.

Record
EUVD-2018-0617
Updated
2026-11-03
GitHub AdvisoriesGHSA-hr2v-3952-633q 9.8

Prototype Pollution in deep-extend

Versions of deep-extend before 0.5.1 are vulnerable to prototype pollution.

Recommendation

Update to version 0.5.1 or later.

Record
GHSA-hr2v-3952-633q
CVSS 3.0
9.8 CriticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-20
Updated
2026-11-02
OSV 9.8

The utilities function in all versions <= 0.5.0 of the deep-extend node module can be tricked into modifying the prototype of Object when the attacker can control part of the structure passed to this function. This can let an attacker add or modify existing properties that will exist on all objects.

Record
CVE-2018-3750
CVSS 3.0
9.8 CriticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVDEBIAN-CVE-2018-3750 9.8

The utilities function in all versions <= 0.5.0 of the deep-extend node module can be tricked into modifying the prototype of Object when the attacker can control part of the structure passed to this function. This can let an attacker add or modify existing properties that will exist on all objects.

Record
DEBIAN-CVE-2018-3750
CVSS 3.0
9.8 CriticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
Show 8 moreShow less
OSVGHSA-hr2v-3952-633q 9.8

Prototype Pollution in deep-extend

Versions of deep-extend before 0.5.1 are vulnerable to prototype pollution.

Recommendation

Update to version 0.5.1 or later.

Record
GHSA-hr2v-3952-633q
CVSS 3.0
9.8 CriticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-20
Updated
2026-11-02
OSVRHSA-2020:2625 7.7

Red Hat Security Advisory: rh-nodejs8-nodejs security update

Record
RHSA-2020:2625
CVSS 3.0
7.7 HighCVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Updated
2026-11-02
OSVRHSA-2021:0485 8.1

Red Hat Security Advisory: rh-nodejs12-nodejs security update

Record
RHSA-2021:0485
CVSS 3.1
8.1 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2021:0549 8.1

Red Hat Security Advisory: nodejs:12 security update

Record
RHSA-2021:0549
CVSS 3.1
8.1 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRLSA-2021:0549 8.1

Moderate: nodejs:12 security update

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.

The following packages have been upgraded to a later upstream version: nodejs (12.20.1), nodejs-nodemon (2.0.3).

Security Fix(es):

  • nodejs-mixin-deep: prototype pollution in function mixin-deep (CVE-2019-10746)

  • nodejs-set-value: prototype pollution in function set-value (CVE-2019-10747)

  • nodejs-npm-user-validate: improper input validation when validating user emails leads to ReDoS (CVE-2020-7754)

  • nodejs-ini: prototype pollution via malicious INI file (CVE-2020-7788)

  • nodejs: use-after-free in the TLS implementation (CVE-2020-8265)

  • nodejs: HTTP request smuggling via two copies of a header field in an http request (CVE-2020-8287)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
RLSA-2021:0549
CVSS 3.1
8.1 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVUBUNTU-CVE-2018-3750 9.8

The utilities function in all versions <= 0.5.0 of the deep-extend node module can be tricked into modifying the prototype of Object when the attacker can control part of the structure passed to this function. This can let an attacker add or modify existing properties that will exist on all objects.

Record
UBUNTU-CVE-2018-3750
CVSS 3.0
9.8 CriticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVALSA-2021:0549 No score

Moderate: nodejs:12 security update

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.

The following packages have been upgraded to a later upstream version: nodejs (12.20.1), nodejs-nodemon (2.0.3).

Security Fix(es):

  • nodejs-mixin-deep: prototype pollution in function mixin-deep (CVE-2019-10746)

  • nodejs-set-value: prototype pollution in function set-value (CVE-2019-10747)

  • nodejs-npm-user-validate: improper input validation when validating user emails leads to ReDoS (CVE-2020-7754)

  • nodejs-ini: prototype pollution via malicious INI file (CVE-2020-7788)

  • nodejs: use-after-free in the TLS implementation (CVE-2020-8265)

  • nodejs: HTTP request smuggling via two copies of a header field in an http request (CVE-2020-8287)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
ALSA-2021:0549
Updated
2026-11-02
OSVCLSA-2026-1774484512 No score

TuxCare security update for deep-extend (1 CVE)

TuxCare rebuilt deep-extend to address 1 CVE. Fixed in 0.4.2-tuxcare.1.

Record
CLSA-2026-1774484512
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
deep-extend
npm
 before 0.5.1
0.5.1
nodejs-nodemon
AlmaLinux:8
 before 2.0.3-1.module_el8.4.0+2521+c668cc9f
2.0.3-1.module_el8.4.0+2521+c668cc9f
nodejs-packaging
AlmaLinux:8
 before 17-3.module_el8.4.0+2224+b07ac28e
17-3.module_el8.4.0+2224+b07ac28e
nodejs-packaging
AlmaLinux:8
 before 17-3.module_el8.4.0+2521+c668cc9f
17-3.module_el8.4.0+2521+c668cc9f
nodejs-packaging
AlmaLinux:8
 before 17-3.module_el8.3.0+2023+d2377ea3
17-3.module_el8.3.0+2023+d2377ea3
deep-extend
TuxCare:npm
 0.4.2-tuxcare.0 up to 0.4.2-tuxcare.1, plus listed versions
0.4.2
0.4.2-tuxcare.1
node-deep-extend
Debian:12
 before 0.4.1-2
0.4.1-2
node-deep-extend
Debian:13
 before 0.4.1-2
0.4.1-2
node-deep-extend
Debian:14
 before 0.4.1-2
0.4.1-2
rh-nodejs8-nodejs
Red Hat:rhel_software_collections:3::el7
 before 0:8.17.0-2.el7
0:8.17.0-2.el7
Show 24 moreShow less
Affected packages
PackageAffectedFixed
rh-nodejs8-nodejs-debuginfo
Red Hat:rhel_software_collections:3::el7
 before 0:8.17.0-2.el7
0:8.17.0-2.el7
rh-nodejs8-nodejs-devel
Red Hat:rhel_software_collections:3::el7
 before 0:8.17.0-2.el7
0:8.17.0-2.el7
rh-nodejs8-nodejs-docs
Red Hat:rhel_software_collections:3::el7
 before 0:8.17.0-2.el7
0:8.17.0-2.el7
rh-nodejs8-npm
Red Hat:rhel_software_collections:3::el7
 before 0:6.13.4-8.17.0.2.el7
0:6.13.4-8.17.0.2.el7
rh-nodejs12-nodejs
Red Hat:rhel_software_collections:3::el7
 before 0:12.20.1-1.el7
0:12.20.1-1.el7
rh-nodejs12-nodejs-debuginfo
Red Hat:rhel_software_collections:3::el7
 before 0:12.20.1-1.el7
0:12.20.1-1.el7
rh-nodejs12-nodejs-devel
Red Hat:rhel_software_collections:3::el7
 before 0:12.20.1-1.el7
0:12.20.1-1.el7
rh-nodejs12-nodejs-docs
Red Hat:rhel_software_collections:3::el7
 before 0:12.20.1-1.el7
0:12.20.1-1.el7
rh-nodejs12-nodejs-nodemon
Red Hat:rhel_software_collections:3::el7
 before 0:2.0.3-1.el7
0:2.0.3-1.el7
rh-nodejs12-npm
Red Hat:rhel_software_collections:3::el7
 before 0:6.14.10-12.20.1.1.el7
0:6.14.10-12.20.1.1.el7
nodejs
Red Hat:enterprise_linux:8::appstream
 before 1:12.20.1-1.module+el8.3.0+9503+19cb079c
1:12.20.1-1.module+el8.3.0+9503+19cb079c
nodejs-debuginfo
Red Hat:enterprise_linux:8::appstream
 before 1:12.20.1-1.module+el8.3.0+9503+19cb079c
1:12.20.1-1.module+el8.3.0+9503+19cb079c
nodejs-debugsource
Red Hat:enterprise_linux:8::appstream
 before 1:12.20.1-1.module+el8.3.0+9503+19cb079c
1:12.20.1-1.module+el8.3.0+9503+19cb079c
nodejs-devel
Red Hat:enterprise_linux:8::appstream
 before 1:12.20.1-1.module+el8.3.0+9503+19cb079c
1:12.20.1-1.module+el8.3.0+9503+19cb079c
nodejs-docs
Red Hat:enterprise_linux:8::appstream
 before 1:12.20.1-1.module+el8.3.0+9503+19cb079c
1:12.20.1-1.module+el8.3.0+9503+19cb079c
nodejs-full-i18n
Red Hat:enterprise_linux:8::appstream
 before 1:12.20.1-1.module+el8.3.0+9503+19cb079c
1:12.20.1-1.module+el8.3.0+9503+19cb079c
nodejs-nodemon
Red Hat:enterprise_linux:8::appstream
 before 0:2.0.3-1.module+el8.3.0+9715+1718613f
0:2.0.3-1.module+el8.3.0+9715+1718613f
nodejs-packaging
Red Hat:enterprise_linux:8::appstream
 before 0:17-3.module+el8.1.0+3369+37ae6a45
0:17-3.module+el8.1.0+3369+37ae6a45
npm
Red Hat:enterprise_linux:8::appstream
 before 1:6.14.10-1.12.20.1.1.module+el8.3.0+9503+19cb079c
1:6.14.10-1.12.20.1.1.module+el8.3.0+9503+19cb079c
nodejs-nodemon
Rocky Linux:8
 before 0:2.0.3-1.module+el8.6.0+982+9fdca2d4
0:2.0.3-1.module+el8.6.0+982+9fdca2d4
nodejs-nodemon
Rocky Linux:8
 before 0:2.0.3-1.module+el8.3.0+100+234774f7
0:2.0.3-1.module+el8.3.0+100+234774f7
nodejs-nodemon
Rocky Linux:8
 before 0:2.0.3-1.module+el8.4.0+638+5344c6f7
0:2.0.3-1.module+el8.4.0+638+5344c6f7
nodejs-packaging
Rocky Linux:8
 before 0:17-3.module+el8.3.0+101+f84c7154
0:17-3.module+el8.3.0+101+f84c7154
node-deep-extend
Ubuntu:18.04:LTS
 All versions, plus listed versions
0.4.1-1
 None known

History

History
RecordedChangedSources
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2018-3750 is a critical vulnerability (CVSS 9.8) in Deep Extend Project Extend, published July 3, 2018. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.15%, the 82nd percentile. Fixed in deep-extend 0.5.1.

References

Show 74 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open