{"id":"CVE-2026-54737","aliases":["EUVD-2026-51592","GHSA-mj3g-7xcc-x4vh"],"status":"published","title":"@phun-ky/defaults-deep Has a Prototype Pollution issue via Unsafe Recursive Property Merging","description":"@phun-ky/defaults-deep is a library like lodash defaultsDeep with array preservation and no lodash dependency. Prior to 2.0.5, defaultsDeep() recursively merges user-supplied objects without filtering proto, constructor, and prototype, allowing properties to be written to Object.prototype. This issue is fixed in version 2.0.5.","severity":{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.00455,"percentile":0.39927,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-1321"],"published":"2026-07-31T17:48:42Z","modified":"2026-10-28T02:30:45Z","fixes":[{"ecosystem":"npm","package":"@phun-ky/defaults-deep","fixed_in":["2.0.5"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"@phun-ky/defaults-deep","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.5"}]}]},{"source":"osv","ecosystem":"npm","package":"@phun-ky/defaults-deep","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"2.0.5"}]}]}],"products":[{"vendor":"hackerone","product":"defaults-deep"},{"vendor":"phun-ky","product":"defaults-deep"}],"references":[{"url":"https://github.com/phun-ky/defaults-deep/security/advisories/GHSA-mj3g-7xcc-x4vh","tags":["x_refsource_CONFIRM","advisory","web"]},{"url":"https://github.com/phun-ky/defaults-deep/pull/49","tags":["x_refsource_MISC","fix","web"]},{"url":"https://github.com/phun-ky/defaults-deep/commit/807dba930f8718f9126cad59d949b8fd3539b059","tags":["x_refsource_MISC","fix","web"]},{"url":"https://github.com/phun-ky/defaults-deep/releases/tag/2.0.5","tags":["x_refsource_MISC","web"]},{"url":"https://github.com/advisories/GHSA-mj3g-7xcc-x4vh"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/54xxx/CVE-2026-54737.json","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-54737","tags":["advisory"]},{"url":"https://github.com/phun-ky/defaults-deep","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2026-54737","title":"@phun-ky/defaults-deep Has a Prototype Pollution issue via Unsafe Recursive Property Merging","description":"@phun-ky/defaults-deep is a library like lodash defaultsDeep with array preservation and no lodash dependency. Prior to 2.0.5, defaultsDeep() recursively merges user-supplied objects without filtering proto, constructor, and prototype, allowing properties to be written to Object.prototype. This issue is fixed in version 2.0.5.","status":"published","published":"2026-07-31T17:48:42.67Z","modified":"2026-07-31T19:00:41.074Z","cvss":[{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","level":"high","assessor":"cna"}],"cwes":["CWE-1321"],"updated_at":"2026-11-02T13:38:09.774038Z"}],"euvd":[{"id":"EUVD-2026-51592","description":"@phun-ky/defaults-deep is a library like lodash defaultsDeep with array preservation and no lodash dependency. Prior to 2.0.5, defaultsDeep() recursively merges user-supplied objects without filtering proto, constructor, and prototype, allowing properties to be written to Object.prototype. This issue is fixed in version 2.0.5.","status":"published","published":"2026-07-31T17:48:42Z","modified":"2026-07-31T19:00:41Z","cvss":[{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","level":"high"}],"updated_at":"2026-11-02T18:02:25.522444Z"}],"ghsa":[{"id":"GHSA-mj3g-7xcc-x4vh","title":"@phun-ky/defaults-deep Has a Prototype Pollution issue via Unsafe Recursive Property Merging","description":"### Impact\n\nA prototype pollution vulnerability exists in @phun-ky/defaults-deep prior to version 2.0.5.\n\nThe library recursively merged user-supplied objects without filtering unsafe property names such as `__proto__`, `constructor`, and `prototype`. An attacker able to supply crafted input could cause properties to be written to `Object.prototype`, resulting in prototype pollution affecting all objects within the running process.\n\nApplications that pass untrusted input to `defaultsDeep()` may be impacted. Depending on how the application uses merged objects, this could lead to unexpected behavior, logic bypasses, denial of service, or other security issues.\n\n### Patches\n\nThis issue has been fixed in version 2.0.5.\n\nUsers should upgrade to version 2.0.5 or later.\n\nThe fix prevents unsafe prototype-related keys (`__proto__`, `constructor`, and `prototype`) from being processed during recursive merge operations and includes regression tests covering known prototype pollution vectors.\n\n### Workarounds\n\nUsers unable to upgrade should ensure that untrusted input is sanitized before being passed to `defaultsDeep()`.\n\nAt a minimum, applications should reject or remove the following property names from all levels of user-controlled objects:\n\n- `__proto__`\n- `constructor`\n- `prototype`\n\nUpgrading to a patched version remains the recommended mitigation.","status":"published","published":"2026-07-31T17:49:08Z","modified":"2026-07-31T17:49:10Z","cvss":[{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","level":"high"}],"cwes":["CWE-1321"],"updated_at":"2026-11-02T14:40:55.903445Z"}],"nvd":[{"id":"CVE-2026-54737","description":"@phun-ky/defaults-deep is a library like lodash defaultsDeep with array preservation and no lodash dependency. Prior to 2.0.5, defaultsDeep() recursively merges user-supplied objects without filtering proto, constructor, and prototype, allowing properties to be written to Object.prototype. This issue is fixed in version 2.0.5.","status":"published","published":"2026-07-31T18:17:17.33Z","modified":"2026-10-23T23:10:00.157Z","cvss":[{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","level":"high","assessor":"secondary"}],"cwes":["CWE-1321"],"updated_at":"2026-11-02T14:12:34.290716Z"}],"osv":[{"id":"CVE-2026-54737","title":"@phun-ky/defaults-deep Has a Prototype Pollution issue via Unsafe Recursive Property Merging","description":"@phun-ky/defaults-deep is a library like lodash defaultsDeep with array preservation and no lodash dependency. Prior to 2.0.5, defaultsDeep() recursively merges user-supplied objects without filtering proto, constructor, and prototype, allowing properties to be written to Object.prototype. This issue is fixed in version 2.0.5.","status":"published","published":"2026-07-31T17:48:42.67Z","modified":"2026-10-28T02:30:45.968873204Z","cvss":[{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","level":"high"}],"cwes":["CWE-1321"],"updated_at":"2026-11-02T15:45:10.818486Z"},{"id":"GHSA-mj3g-7xcc-x4vh","title":"@phun-ky/defaults-deep Has a Prototype Pollution issue via Unsafe Recursive Property Merging","description":"### Impact\n\nA prototype pollution vulnerability exists in @phun-ky/defaults-deep prior to version 2.0.5.\n\nThe library recursively merged user-supplied objects without filtering unsafe property names such as `__proto__`, `constructor`, and `prototype`. An attacker able to supply crafted input could cause properties to be written to `Object.prototype`, resulting in prototype pollution affecting all objects within the running process.\n\nApplications that pass untrusted input to `defaultsDeep()` may be impacted. Depending on how the application uses merged objects, this could lead to unexpected behavior, logic bypasses, denial of service, or other security issues.\n\n### Patches\n\nThis issue has been fixed in version 2.0.5.\n\nUsers should upgrade to version 2.0.5 or later.\n\nThe fix prevents unsafe prototype-related keys (`__proto__`, `constructor`, and `prototype`) from being processed during recursive merge operations and includes regression tests covering known prototype pollution vectors.\n\n### Workarounds\n\nUsers unable to upgrade should ensure that untrusted input is sanitized before being passed to `defaultsDeep()`.\n\nAt a minimum, applications should reject or remove the following property names from all levels of user-controlled objects:\n\n- `__proto__`\n- `constructor`\n- `prototype`\n\nUpgrading to a patched version remains the recommended mitigation.","status":"published","published":"2026-07-31T17:49:08Z","modified":"2026-07-31T18:11:48.291706Z","cvss":[{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","level":"high"}],"cwes":["CWE-1321"],"updated_at":"2026-11-02T15:46:51.811331Z"}]}}