PT-2026-66832 · Npm · Deep-Defaults

CVE-2026-54737 · Published 2026-07-31 · Updated 2026-07-31

Positive Technologies (AI Summary)

CVSS v3.1

7.3

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions @phun-ky/defaults-deep versions prior to 2.0.5

Description Prototype pollution occurs when the defaultsDeep() function recursively merges user-supplied objects without filtering unsafe property names. An attacker can provide crafted input to write properties to Object.prototype, which affects all objects within the running process. This can lead to unexpected behavior, logic bypasses, or denial of service. The issue specifically involves the failure to filter the proto, constructor, and prototype properties.

Recommendations Update to version 2.0.5 or later. As a temporary workaround, sanitize untrusted input by rejecting or removing the proto, constructor, and prototype property names from all levels of user-controlled objects before passing them to the defaultsDeep() function.

Fix

Prototype Pollution

Weakness Enumeration

CWE-1321

Related Identifiers

CVE-2026-54737

GHSA-MJ3G-7XCC-X4VH

Affected Products

Deep-Defaults

References · 7

• https://osv.dev/vulnerability/GHSA-mj3g-7xcc-x4vh · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-54737 · Security Note
• https://github.com/phun-ky/defaults-deep/commit/807dba930f8718f9126cad59d949b8fd3539b059 · Note
• https://github.com/phun-ky/defaults-deep · Note
• https://github.com/phun-ky/defaults-deep/security/advisories/GHSA-mj3g-7xcc-x4vh · Note
• https://github.com/phun-ky/defaults-deep/pull/49 · Note
• https://github.com/phun-ky/defaults-deep/releases/tag/2.0.5 · Note