CVE-2026-54737CWE-1321

CVE-2026-54737

High · published July 31, 2026

CVSS v3.1
7.3
EPSS
0%
Percentile
38.5
In the wild
Unconfirmed
What it is

@phun-ky/defaults-deep is a library like lodash defaultsDeep with array preservation and no lodash dependency. Prior to 2.0.5, defaultsDeep() recursively merges user-supplied objects without filtering proto, constructor, and prototype, allowing properties to be written to Object.prototype. This issue is fixed in version 2.0.5.

The record
Technical detail
CVSS v3.1
7.3 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
CVSS v4.0
Not supplied
EPSS
0.00455 · 38.5th percentile
Weakness
CWE-1321 · Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')
Published
2026-07-31T22:17Z
References (4)
https://github.com/phun-ky/defaults-deep/commit/807dba930f8718f9126cad59d949b8fd3539b059 · [email protected]https://github.com/phun-ky/defaults-deep/pull/49 · [email protected]https://github.com/phun-ky/defaults-deep/releases/tag/2.0.5 · [email protected]https://github.com/phun-ky/defaults-deep/security/advisories/GHSA-mj3g-7xcc-x4vh · [email protected]
EPSS history
Timeline
  • 31 JUL 17:48Z
    @phun-ky/defaults-deep Has a Prototype Pollution issue via Unsafe Recursive Property Merging
    cvelistv5