{"id":"GHSA-mj3g-7xcc-x4vh","revision":"503b14493d134aab9c631379f489c47e","records":[{"revision":"503b14493d134aab9c631379f489c47e","observedAt":"2026-10-24T13:17:17.793+00:00","statement":{"source":"osv","id":"GHSA-mj3g-7xcc-x4vh","aliases":["CVE-2026-54737"],"title":"@phun-ky/defaults-deep Has a Prototype Pollution issue via Unsafe Recursive Property Merging","description":"### Impact\n\nA prototype pollution vulnerability exists in @phun-ky/defaults-deep prior to version 2.0.5.\n\nThe library recursively merged user-supplied objects without filtering unsafe property names such as `__proto__`, `constructor`, and `prototype`. An attacker able to supply crafted input could cause properties to be written to `Object.prototype`, resulting in prototype pollution affecting all objects within the running process.\n\nApplications that pass untrusted input to `defaultsDeep()` may be impacted. Depending on how the application uses merged objects, this could lead to unexpected behavior, logic bypasses, denial of service, or other security issues.\n\n### Patches\n\nThis issue has been fixed in version 2.0.5.\n\nUsers should upgrade to version 2.0.5 or later.\n\nThe fix prevents unsafe prototype-related keys (`__proto__`, `constructor`, and `prototype`) from being processed during recursive merge operations and includes regression tests covering known prototype pollution vectors.\n\n### Workarounds\n\nUsers unable to upgrade should ensure that untrusted input is sanitized before being passed to `defaultsDeep()`.\n\nAt a minimum, applications should reject or remove the following property names from all levels of user-controlled objects:\n\n- `__proto__`\n- `constructor`\n- `prototype`\n\nUpgrading to a patched version remains the recommended mitigation.","state":0,"publishedAt":"2026-07-31T17:49:08+00:00","modifiedAt":"2026-07-31T18:11:48.291706+00:00","affected":[{"ecosystem":"npm","name":"@phun-ky/defaults-deep","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"},{"kind":"fixed","version":"2.0.5"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[{"system":"CVSS_V3","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","score":null,"severity":null},{"system":"Publisher rating","vector":null,"score":null,"severity":"HIGH"}],"references":["https://github.com/phun-ky/defaults-deep/security/advisories/GHSA-mj3g-7xcc-x4vh","https://github.com/phun-ky/defaults-deep/pull/49","https://github.com/phun-ky/defaults-deep/commit/807dba930f8718f9126cad59d949b8fd3539b059","https://github.com/phun-ky/defaults-deep","https://github.com/phun-ky/defaults-deep/releases/tag/2.0.5"],"sourceUrl":"https://github.com/advisories/GHSA-mj3g-7xcc-x4vh","license":"GitHub Advisory Database · CC-BY-4.0","key":"osv:GHSA-mj3g-7xcc-x4vh","identifiers":["GHSA-mj3g-7xcc-x4vh","CVE-2026-54737"]},"retained":false,"historicalAffected":[]}],"coverage":[]}