Read the docs
TI-2020-06282 Aliases CVE-2020-7765GHSA-fpm5-vv97-jfwg

Prototype pollution in @firebase/util

Priority LOW 26CWE-400Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
High
Impact type
Denial of service
Confidentiality · integrity · availability
Low · Low · Low
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-400.

Summary

This affects the package @firebase/util before 0.3.4. This vulnerability relates to the deepExtend function within the DeepCopy.ts file. Depending on if user input is provided, an attacker can overwrite and pollute the object prototype of a program.

Why it matters now

EPSS 0.00569 47th percentileScored 2026-11-07
Fix Fixed @firebase/util: 0.3.4@firebase/util (npm): 0.3.4

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
—@firebase/utilbefore 0.3.40.3.4Patch availableCNA
—@firebase/util (npm)before 0.3.40.3.4Patch availableGHSA-fpm5-vv97-jfwg
  • @firebase/util Vendor— Affected before 0.3.4 Fixed in 0.3.4 Patch available CNA
  • @firebase/util (npm) Vendor— Affected before 0.3.4 Fixed in 0.3.4 Patch available GHSA-fpm5-vv97-jfwg

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:google:firebase\/util:*:*:*:*:*:node.js:*:*before 0.3.4VulnerableGoogle
  • cpe:2.3:a:google:firebase\/util:*:*:*:*:*:node.js:*:* Versions before 0.3.4 Vulnerable ·Google

Remediation

  • Fix · CNA @firebase/util Fixed in 0.3.4
  • Fix · GHSA-fpm5-vv97-jfwg @firebase/util (npm) Fixed in 0.3.4 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2020-7765
  2. 2026-10-03 Alias added: GHSA-fpm5-vv97-jfwg

References

Patch 2

Advisory 1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences