CVE-2026-25047CWE-1321

deepHas vulnerable to Prototype Pollution via constructor.prototype

Critical · published January 29, 2026

CVSS v4.0
9.4
EPSS
1%
Percentile
56.4
In the wild
Unconfirmed
What it is

deepHas provides a test for the existence of a nested object key and optionally returns that key. A prototype pollution vulnerability exists in version 1.0.7 of the deephas npm package that allows an attacker to modify global object behavior. This issue was fixed in version 1.0.8.

The record
Technical detail
CVSS v4.0
9.4 · CRITICAL
Vector
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
EPSS
0.00808 · 56.4th percentile
Weakness
CWE-1321 · Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')
Published
2026-01-29T21:39Z
EPSS history
Timeline
  • 29 JAN 21:39Z
    deepHas vulnerable to Prototype Pollution via constructor.prototype
    cvelistv5