@phun-ky/defaults-deep Has a Prototype Pollution issue via Unsafe Recursive Property Merging
Priority LOW 38CWE-1321Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- Low · Low · Low
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub.
Summary
@phun-ky/defaults-deep is a library like lodash defaultsDeep with array preservation and no lodash dependency. Prior to 2.0.5, defaultsDeep() recursively merges user-supplied objects without filtering proto, constructor, and prototype, allowing properties to be written to Object.prototype. This issue is fixed in version 2.0.5.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00455 39th percentileScored 2026-11-07
Fix Fixed defaults-deep (phun-ky): 2.0.5@phun-ky/defaults-deep (npm): 2.0.5
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| phun-ky | defaults-deep | before 2.0.5 | 2.0.5 | Patch available | CNA |
| — | @phun-ky/defaults-deep (npm) | before 2.0.5 | 2.0.5 | Patch available | GHSA-mj3g-7xcc-x4vh |
- defaults-deep Vendorphun-ky Affected before 2.0.5 Fixed in 2.0.5 Patch available CNA
- @phun-ky/defaults-deep (npm) Vendor— Affected before 2.0.5 Fixed in 2.0.5 Patch available GHSA-mj3g-7xcc-x4vh
Remediation
- Fix · CNA defaults-deep (phun-ky) Fixed in 2.0.5
- Fix · GHSA-mj3g-7xcc-x4vh @phun-ky/defaults-deep (npm) Fixed in 2.0.5 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2026-54737
- 2026-10-03 Alias added: GHSA-mj3g-7xcc-x4vh
References
Other 5
- https://github.com/phun-ky/defaults-deep/security/advisories/GHSA-mj3g-7xcc-x4vh
- https://github.com/phun-ky/defaults-deep/pull/49
- https://github.com/phun-ky/defaults-deep/commit/807dba930f8718f9126cad59d949b8fd3539b059
- https://github.com/phun-ky/defaults-deep/releases/tag/2.0.5
- https://github.com/phun-ky/defaults-deep
Sources
- CVE-2026-54737 · CVE Program
- CVE-2026-54737 · NVD
- FIRST EPSS
- GHSA-mj3g-7xcc-x4vh · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences