{"id":"CVE-2018-3750","aliases":["ALSA-2021:0549","CLSA-2026-1774484512","DEBIAN-CVE-2018-3750","EUVD-2018-0617","GHSA-hr2v-3952-633q","RHSA-2020:2625","RHSA-2021:0485","RHSA-2021:0549","RLSA-2021:0549","UBUNTU-CVE-2018-3750"],"status":"published","title":"Prototype Pollution in deep-extend","description":"The utilities function in all versions \u003c= 0.5.0 of the deep-extend node module can be tricked into modifying the prototype of Object when the attacker can control part of the structure passed to this function. This can let an attacker add or modify existing properties that will exist on all objects.","severity":{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.02114,"percentile":0.81952,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-20"],"published":"2018-07-03T21:00:00Z","modified":"2026-10-29T11:12:06Z","fixes":[{"ecosystem":"npm","package":"deep-extend","fixed_in":["0.5.1"],"sources":["ghsa","osv"]},{"ecosystem":"TuxCare:npm","package":"deep-extend","fixed_in":["0.4.2-tuxcare.1"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"node-deep-extend","fixed_in":["0.4.1-2"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"node-deep-extend","fixed_in":["0.4.1-2"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"node-deep-extend","fixed_in":["0.4.1-2"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"deep-extend","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.5.1"}]}]},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.3-1.module_el8.4.0+2521+c668cc9f"}]}],"bundled":7},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"17-3.module_el8.4.0+2224+b07ac28e"}]}],"bundled":7},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"17-3.module_el8.4.0+2521+c668cc9f"}]}],"bundled":7},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"17-3.module_el8.3.0+2023+d2377ea3"}]}],"bundled":7},{"source":"osv","ecosystem":"TuxCare:npm","package":"deep-extend","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.4.2-tuxcare.0"},{"fixed":"0.4.2-tuxcare.1"}]}],"versions":["0.4.2"]},{"source":"osv","ecosystem":"Debian:12","package":"node-deep-extend","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.4.1-2"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"node-deep-extend","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.4.1-2"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"node-deep-extend","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.4.1-2"}]}]},{"source":"osv","ecosystem":"npm","package":"deep-extend","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"0.5.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-nodejs8-nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.17.0-2.el7"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-nodejs8-nodejs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.17.0-2.el7"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-nodejs8-nodejs-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.17.0-2.el7"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-nodejs8-nodejs-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.17.0-2.el7"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-nodejs8-npm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.13.4-8.17.0.2.el7"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-nodejs12-nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:12.20.1-1.el7"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-nodejs12-nodejs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:12.20.1-1.el7"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-nodejs12-nodejs-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:12.20.1-1.el7"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-nodejs12-nodejs-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:12.20.1-1.el7"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-nodejs12-nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.3-1.el7"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-nodejs12-npm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.14.10-12.20.1.1.el7"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:12.20.1-1.module+el8.3.0+9503+19cb079c"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:12.20.1-1.module+el8.3.0+9503+19cb079c"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:12.20.1-1.module+el8.3.0+9503+19cb079c"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:12.20.1-1.module+el8.3.0+9503+19cb079c"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:12.20.1-1.module+el8.3.0+9503+19cb079c"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-full-i18n","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:12.20.1-1.module+el8.3.0+9503+19cb079c"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.3-1.module+el8.3.0+9715+1718613f"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:17-3.module+el8.1.0+3369+37ae6a45"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"npm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:6.14.10-1.12.20.1.1.module+el8.3.0+9503+19cb079c"}]}],"bundled":7},{"source":"osv","ecosystem":"Rocky Linux:8","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.3-1.module+el8.6.0+982+9fdca2d4"}]}],"bundled":7},{"source":"osv","ecosystem":"Rocky Linux:8","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.3-1.module+el8.3.0+100+234774f7"}]}],"bundled":7},{"source":"osv","ecosystem":"Rocky Linux:8","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.3-1.module+el8.4.0+638+5344c6f7"}]}],"bundled":7},{"source":"osv","ecosystem":"Rocky Linux:8","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:17-3.module+el8.3.0+101+f84c7154"}]}],"bundled":7},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"node-deep-extend","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.4.1-1"]}],"products":[{"vendor":"deep_extend_project","product":"deep_extend"}],"references":[{"url":"https://hackerone.com/reports/311333","tags":["x_refsource_MISC","x_transferred","Exploit","Issue Tracking","Third Party Advisory","report","web","article"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2018-3750","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-hr2v-3952-633q","tags":["advisory"]},{"url":"https://www.npmjs.com/advisories/612","tags":["web"]},{"url":"https://github.com/unclechu/node-deep-extend/commit/9423fae877e2ab6b4aecc4db79a0ed63039d4703","tags":["web"]},{"url":"https://errata.almalinux.org/8/ALSA-2021-0549.html","tags":["advisory"]},{"url":"https://vulners.com/cve/CVE-2018-3750","tags":["report"]},{"url":"https://vulners.com/cve/CVE-2019-10746","tags":["report"]},{"url":"https://vulners.com/cve/CVE-2019-10747","tags":["report"]},{"url":"https://vulners.com/cve/CVE-2020-7754","tags":["report"]},{"url":"https://vulners.com/cve/CVE-2020-7788","tags":["report"]},{"url":"https://vulners.com/cve/CVE-2020-8265","tags":["report"]},{"url":"https://vulners.com/cve/CVE-2020-8287","tags":["report"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2018-3750","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2020:2625","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1448380","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1567228","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1578246","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1611613","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1788301","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1788305","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1788310","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1829414","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2020/rhsa-2020_2625.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2017-18077","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2017-18077","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2017-18077","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2017-18869","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2017-18869","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2017-18869","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2018-3737","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2018-3737","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2018-3737","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2018-3750","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2018-3750","tags":["advisory","report"]},{"url":"https://nodesecurity.io/advisories/612","tags":["article","report"]},{"url":"https://access.redhat.com/security/cve/CVE-2019-16775","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-16775","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-16775","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2019-16776","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-16776","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-16776","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2019-16777","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-16777","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-16777","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2021:0485","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1795475","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1795479","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1892430","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1907444","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1912854","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1912863","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2021/rhsa-2021_0485.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2019-10746","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-10746","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-10746","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2019-10747","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-10747","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-10747","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2020-7754","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-7754","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-7754","tags":["advisory"]},{"url":"https://github.com/npm/npm-user-validate/security/advisories/GHSA-xgh6-85xh-479p","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2020-7788","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-7788","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-7788","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2020-8265","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-8265","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-8265","tags":["advisory"]},{"url":"https://hackerone.com/reports/988103","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2020-8287","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-8287","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-8287","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2021:0549","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2021/rhsa-2021_0549.json","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2021:0549","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2018-3750","tags":["report"]},{"url":"https://github.com/unclechu/node-deep-extend/issues/39","tags":["report"]},{"url":"https://github.com/unclechu/node-deep-extend/pull/40","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2018-3750","description":"The utilities function in all versions \u003c= 0.5.0 of the deep-extend node module can be tricked into modifying the prototype of Object when the attacker can control part of the structure passed to this function. This can let an attacker add or modify existing properties that will exist on all objects.","status":"published","published":"2018-07-03T21:00:00Z","modified":"2024-09-17T02:05:32.183Z","updated_at":"2026-11-02T14:35:05.262903Z"}],"euvd":[{"id":"EUVD-2018-0617","description":"The utilities function in all versions \u003c= 0.5.0 of the deep-extend node module can be tricked into modifying the prototype of Object when the attacker can control part of the structure passed to this function. This can let an attacker add or modify existing properties that will exist on all objects.","status":"published","published":"2018-07-03T21:00:00Z","modified":"2024-09-17T02:05:32Z","updated_at":"2026-11-03T00:28:43.867146Z"}],"ghsa":[{"id":"GHSA-hr2v-3952-633q","title":"Prototype Pollution in deep-extend","description":"Versions of `deep-extend` before 0.5.1 are vulnerable to prototype pollution.\n\n\n## Recommendation\n\nUpdate to version 0.5.1 or later.","status":"published","published":"2018-10-09T00:44:59Z","modified":"2025-02-12T05:10:31Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-20"],"updated_at":"2026-11-02T14:38:30.754382Z"}],"nvd":[{"id":"CVE-2018-3750","description":"The utilities function in all versions \u003c= 0.5.0 of the deep-extend node module can be tricked into modifying the prototype of Object when the attacker can control part of the structure passed to this function. This can let an attacker add or modify existing properties that will exist on all objects.","status":"published","published":"2018-07-03T21:29:00.62Z","modified":"2026-06-17T01:57:46.103Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"},{"version":"2.0","score":7.5,"vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","level":"high","assessor":"primary"}],"cwes":["CWE-20"],"updated_at":"2026-11-02T14:04:30.900603Z"}],"osv":[{"id":"CVE-2018-3750","description":"The utilities function in all versions \u003c= 0.5.0 of the deep-extend node module can be tricked into modifying the prototype of Object when the attacker can control part of the structure passed to this function. This can let an attacker add or modify existing properties that will exist on all objects.","status":"published","published":"2018-07-03T21:29:00.62Z","modified":"2026-10-29T11:12:06.988608661Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:44:09.442568Z"},{"id":"DEBIAN-CVE-2018-3750","description":"The utilities function in all versions \u003c= 0.5.0 of the deep-extend node module can be tricked into modifying the prototype of Object when the attacker can control part of the structure passed to this function. This can let an attacker add or modify existing properties that will exist on all objects.","status":"published","published":"2018-07-03T21:29:00.62Z","modified":"2026-10-23T18:03:57.410454432Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:45:30.867575Z"},{"id":"GHSA-hr2v-3952-633q","title":"Prototype Pollution in deep-extend","description":"Versions of `deep-extend` before 0.5.1 are vulnerable to prototype pollution.\n\n\n## Recommendation\n\nUpdate to version 0.5.1 or later.","status":"published","published":"2018-10-09T00:44:59Z","modified":"2023-11-08T04:00:18.842083Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-20"],"updated_at":"2026-11-02T15:46:49.621585Z"},{"id":"RHSA-2020:2625","title":"Red Hat Security Advisory: rh-nodejs8-nodejs security update","status":"published","published":"2024-09-13T16:20:13Z","modified":"2026-06-28T10:37:33Z","cvss":[{"version":"3.0","score":7.7,"vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:53:07.072948Z"},{"id":"RHSA-2021:0485","title":"Red Hat Security Advisory: rh-nodejs12-nodejs security update","status":"published","published":"2024-09-13T22:44:36Z","modified":"2026-06-28T10:42:22Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:08.071325Z"},{"id":"RHSA-2021:0549","title":"Red Hat Security Advisory: nodejs:12 security update","status":"published","published":"2024-09-13T22:43:49Z","modified":"2026-06-28T10:42:29Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:08.071325Z"},{"id":"RLSA-2021:0549","title":"Moderate: nodejs:12 security update","description":"Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. \n\nThe following packages have been upgraded to a later upstream version: nodejs (12.20.1), nodejs-nodemon (2.0.3).\n\nSecurity Fix(es):\n\n* nodejs-mixin-deep: prototype pollution in function mixin-deep (CVE-2019-10746)\n\n* nodejs-set-value: prototype pollution in function set-value (CVE-2019-10747)\n\n* nodejs-npm-user-validate: improper input validation when validating user emails leads to ReDoS (CVE-2020-7754)\n\n* nodejs-ini: prototype pollution via malicious INI file (CVE-2020-7788)\n\n* nodejs: use-after-free in the TLS implementation (CVE-2020-8265)\n\n* nodejs: HTTP request smuggling via two copies of a header field in an http request (CVE-2020-8287)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2021-02-16T07:34:29Z","modified":"2026-02-05T12:15:07.1896Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:23.969672Z"},{"id":"UBUNTU-CVE-2018-3750","description":"The utilities function in all versions \u003c= 0.5.0 of the deep-extend node module can be tricked into modifying the prototype of Object when the attacker can control part of the structure passed to this function. This can let an attacker add or modify existing properties that will exist on all objects.","status":"published","published":"2018-07-03T21:29:00Z","modified":"2025-10-24T04:46:47Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:54:18.33562Z"},{"id":"ALSA-2021:0549","title":"Moderate: nodejs:12 security update","description":"Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. \n\nThe following packages have been upgraded to a later upstream version: nodejs (12.20.1), nodejs-nodemon (2.0.3).\n\nSecurity Fix(es):\n\n* nodejs-mixin-deep: prototype pollution in function mixin-deep (CVE-2019-10746)\n\n* nodejs-set-value: prototype pollution in function set-value (CVE-2019-10747)\n\n* nodejs-npm-user-validate: improper input validation when validating user emails leads to ReDoS (CVE-2020-7754)\n\n* nodejs-ini: prototype pollution via malicious INI file (CVE-2020-7788)\n\n* nodejs: use-after-free in the TLS implementation (CVE-2020-8265)\n\n* nodejs: HTTP request smuggling via two copies of a header field in an http request (CVE-2020-8287)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2021-02-16T07:34:29Z","modified":"2026-10-29T11:12:03.862338147Z","updated_at":"2026-11-02T15:27:51.196609Z"},{"id":"CLSA-2026-1774484512","title":"TuxCare security update for deep-extend (1 CVE)","description":"TuxCare rebuilt deep-extend to address 1 CVE. Fixed in 0.4.2-tuxcare.1.","status":"published","published":"2026-08-04T14:52:15Z","modified":"2026-10-15T09:47:03.633545117Z","updated_at":"2026-11-02T15:43:43.621843Z"}]}}