CVE-2026-54737 describes a prototype pollution vulnerability in the phun-ky defaults-deep library before version 2.0.5. The vulnerability arises because the defaultsDeep() function merges objects recursively without filtering keys such as proto, constructor, and prototype, enabling modification of Object.prototype. This can lead to improper control over object prototype attributes, classified under CWE-1321. The vulnerability has a CVSS 3.1 base score of 7.3, indicating high severity with network attack vector, low attack complexity, no privileges or user interaction required, and impacts on confidentiality, integrity, and availability. The issue is resolved in version 2.0.5.

An attacker can exploit this vulnerability remotely without authentication or user interaction to modify Object.prototype. This can result in data corruption, application logic manipulation, or denial of service, impacting confidentiality, integrity, and availability of affected systems using vulnerable versions of the library.

Upgrade to phun-ky defaults-deep version 2.0.5 or later, where the vulnerability is fixed. Patch status is confirmed by the vendor advisory indicating the fix in 2.0.5. No other mitigation is specified.