PT-2026-5362 · Npm · Deephas

Kevgeoleo + 2 · Published 2026-01-29 · Updated 2026-01-30 · CVE-2026-25047

Positive Technologies (AI Summary)

CVSS v4.0

9.4

Critical

Base vector

AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Name of the Vulnerable Software and Affected Versions deephas version 1.0.7 deephas versions prior to 1.0.8

Description A prototype pollution issue exists in the deephas npm package. This allows an attacker to modify global object behavior by injecting properties into Object.prototype. The issue resides in the add() function and indexer() function within deepHas.js. The vulnerability can be bypassed by manipulating Object.prototype.hasOwnProperty or String.prototype.indexOf. Exploitation can lead to authentication bypass, denial of service, and potentially remote code execution if polluted properties are passed to vulnerable sinks.

Recommendations deephas versions prior to 1.0.8 should be updated to version 1.0.8 or later.

Exploit

Fix

Prototype Pollution

Weakness Enumeration

CWE-1321

Related Identifiers

CVE-2026-25047

GHSA-2733-6C58-PF27

Affected Products

Deephas

References · 11

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/25xxx/CVE-2026-25047.json · Exploit
• https://github.com/sharpred/deepHas/security/advisories/GHSA-2733-6c58-pf27 · Vendor Advisory
• https://github.com/sharpred/deepHas/commit/8097fafd3776c613d8066546653e0d2c7b5fc465 · Patch
• https://osv.dev/vulnerability/GHSA-2733-6c58-pf27 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-25047 · Security Note
• https://osv.dev/vulnerability/CVE-2026-25047 · Vendor Advisory
• https://github.com/sharpred/deepHas · Note
• https://twitter.com/CVEnew/status/2017000653327892866 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2017073051989402083 · Twitter Post
• https://twitter.com/pulsepatchio/status/2017247700438114806 · Twitter Post
• https://twitter.com/0dayPublishing/status/2016993871700361676 · Twitter Post