CVE-2026-54737
@phun-ky/defaults-deep Has a Prototype Pollution issue via Unsafe Recursive Property Merging
CVSS Score
7.3
EPSS Score
0.0%
EPSS Percentile
0th
@phun-ky/defaults-deep is a library like lodash defaultsDeep with array preservation and no lodash dependency. Prior to 2.0.5, defaultsDeep() recursively merges user-supplied objects without filtering proto, constructor, and prototype, allowing properties to be written to Object.prototype. This issue is fixed in version 2.0.5.
| CWE | CWE-1321 |
| Vendor | phun-ky |
| Product | defaults-deep |
| Published | Jul 31, 2026 |
Stay Ahead of the Next One
Get instant alerts for phun-ky defaults-deep
Be the first to know when new high vulnerabilities affecting phun-ky defaults-deep are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
Low
Integrity
Low
Availability
Low
Affected Versions
phun-ky / defaults-deep
< 2.0.5
References
github.com: https://github.com/phun-ky/defaults-deep/security/advisories/GHSA-mj3g-7xcc-x4vh github.com: https://github.com/phun-ky/defaults-deep/pull/49 github.com: https://github.com/phun-ky/defaults-deep/commit/807dba930f8718f9126cad59d949b8fd3539b059 github.com: https://github.com/phun-ky/defaults-deep/releases/tag/2.0.5