Read the docs
TI-2019-08011 Aliases CVE-2019-10746GHSA-fhjf-83wg-r2j9

mixin-deep is vulnerable to Prototype Pollution in versions before 1.3.2 and version…

Priority MEDIUM 48CWE-88Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Partial Red Hat: 5 fixed, 4 without a fix

Attack profile from CVSS 3.1 · NVD. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-88.

Summary

mixin-deep is vulnerable to Prototype Pollution in versions before 1.3.2 and version 2.0.0. The function mixin-deep could be tricked into adding or modifying properties of Object.prototype using a constructor payload.

Why it matters now

EPSS 0.03651 89th percentileScored 2026-11-07
Fix Partial mixin-deep (npm): 1.3.2, 2.0.1Red Hat: 2 advisoriesRed Hat: 5 fixed, 4 without a fix

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
—mixin-deepAll versions before 1.3.2 and version 2.0.0.—No fix listedCNA
—mixin-deep (npm)before 1.3.21.3.2Patch availableGHSA-fhjf-83wg-r2j9
—mixin-deep (npm)2.0.0 to before 2.0.12.0.1Patch availableGHSA-fhjf-83wg-r2j9
  • mixin-deep Vendor— Affected All versions before 1.3.2 and version 2.0.0. Fixed in — No fix listed CNA
  • mixin-deep (npm) Vendor— Affected before 1.3.2 Fixed in 1.3.2 Patch available GHSA-fhjf-83wg-r2j9
  • mixin-deep (npm) Vendor— Affected 2.0.0 to before 2.0.1 Fixed in 2.0.1 Patch available GHSA-fhjf-83wg-r2j9

CPE configurations NVD · 5

CPEVersionsRoleVendor
cpe:2.3:a:mixin-deep_project:mixin-deep:*:*:*:*:*:node.js:*:*before 1.3.2VulnerableMixin-deep Project
cpe:2.3:a:mixin-deep_project:mixin-deep:2.0.0:*:*:*:*:node.js:*:*2.0.0VulnerableMixin-deep Project
cpe:2.3:o:fedoraproject:fedora:30:*:*:*:*:*:*:*30VulnerableFedoraproject
cpe:2.3:o:fedoraproject:fedora:31:*:*:*:*:*:*:*31VulnerableFedoraproject
cpe:2.3:a:oracle:communications_cloud_native_core_network_function_cloud_native_environment:1.4.0:*:*:*:*:*:*:*1.4.0VulnerableOracle
  • cpe:2.3:a:mixin-deep_project:mixin-deep:*:*:*:*:*:node.js:*:* Versions before 1.3.2 Vulnerable ·Mixin-deep Project
  • cpe:2.3:a:mixin-deep_project:mixin-deep:2.0.0:*:*:*:*:node.js:*:* Versions 2.0.0 Vulnerable ·Mixin-deep Project
  • cpe:2.3:o:fedoraproject:fedora:30:*:*:*:*:*:*:* Versions 30 Vulnerable ·Fedoraproject
  • cpe:2.3:o:fedoraproject:fedora:31:*:*:*:*:*:*:* Versions 31 Vulnerable ·Fedoraproject
  • cpe:2.3:a:oracle:communications_cloud_native_core_network_function_cloud_native_environment:1.4.0:*:*:*:*:*:*:* Versions 1.4.0 Vulnerable ·Oracle

Remediation

  • Fix · GHSA-fhjf-83wg-r2j9 mixin-deep (npm) Fixed in 1.3.2 Advisory →
  • Fix · GHSA-fhjf-83wg-r2j9 mixin-deep (npm) Fixed in 2.0.1 Advisory →

Red Hat 2 advisories

  • RHSA-2021:0549 Released 2021-02-16 · Red Hat rating Moderate
    nodejs:12 security update
    • Red Hat Enterprise Linux AppStream (v. 8) nodejs-1:12.20.1-1.module+el8.3.0+9503+19cb079c.aarch64::nodejs:12, nodejs-1:12.20.1-1.module+el8.3.0+9503+19cb079c.ppc64le::nodejs:12, nodejs-1:12.20.1-1.module+el8.3.0+9503+19cb079c.s390x::nodejs:12 +19
  • RHSA-2021:0485 Released 2021-02-11 · Red Hat rating Moderate
    rh-nodejs12-nodejs security update
    • Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7) rh-nodejs12-nodejs-12.20.1-1.el7, rh-nodejs12-nodejs-devel-12.20.1-1.el7, rh-nodejs12-nodejs-docs-12.20.1-1.el7 +2
    • Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.6) rh-nodejs12-nodejs-12.20.1-1.el7, rh-nodejs12-nodejs-devel-12.20.1-1.el7, rh-nodejs12-nodejs-docs-12.20.1-1.el7 +2
    • Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.7) rh-nodejs12-nodejs-12.20.1-1.el7, rh-nodejs12-nodejs-devel-12.20.1-1.el7, rh-nodejs12-nodejs-docs-12.20.1-1.el7 +2
    • Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7) rh-nodejs12-nodejs-12.20.1-1.el7, rh-nodejs12-nodejs-devel-12.20.1-1.el7, rh-nodejs12-nodejs-docs-12.20.1-1.el7 +2

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Enterprise Linux 8AffectedNo fix yet: Fix deferred
Red Hat OpenShift Container Platform 3.11AffectedNo fix yet: Fix deferred
Red Hat OpenShift Container Platform 4AffectedNo fix yet: Fix deferred
Red Hat Software CollectionsAffectedNo fix yet: Fix deferred
Red Hat Enterprise Linux AppStream (v. 8)Fixed RHSA-2021:0549
Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7)Fixed RHSA-2021:0485
Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.6)Fixed RHSA-2021:0485
Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.7)Fixed RHSA-2021:0485
Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7)Fixed RHSA-2021:0485
Not affected: 4 products
  • Logging Subsystem for Red Hat OpenShift
  • Red Hat Enterprise Linux 8
  • Red Hat Quay 3
  • Red Hat Software Collections

Timeline

  1. 2026-10-02 Threatist record created from CVE-2019-10746
  2. 2026-10-03 Alias added: GHSA-fhjf-83wg-r2j9

References

Patch 1

Advisory 3

Other 5

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences