CVE-2026-54737: CWE-1321: Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') in phun-ky defaults-deep
### Impact A prototype pollution vulnerability exists in @phun-ky/defaults-deep prior to version 2.0.5. The library recursively merged user-supplied objects without filtering unsafe property names such as `__proto__`, `constructor`, and `prototype`. An attacker able to supply crafted input could cause properties to be written to `Object.prototype`, resulting in prototype pollution affecting all objects within the running process. Applications that pass untrusted input to `defaultsDeep()` may be impacted. Depending on how the application uses merged objects, this could lead to unexpected behavior, logic bypasses, denial of service, or other security issues. ### Patches This issue has been fixed in version 2.0.5. Users should upgrade to version 2.0.5 or later. The fix prevents unsafe prototype-related keys (`__proto__`, `constructor`, and `prototype`) from being processed during recursive merge operations and includes regression tests covering known prototype pollution vectors. ### Workarounds Users unable to upgrade should ensure that untrusted input is sanitized before being passed to `defaultsDeep()`. At a minimum, applications should reject or remove the following property names from all levels of user-controlled objects: - `__proto__` - `constructor` - `prototype` Upgrading to a patched version remains the recommended mitigation.
AI Analysis
Technical Summary
CVE-2026-54737 describes a prototype pollution vulnerability in the phun-ky defaults-deep library before version 2.0.5. The vulnerability arises because the defaultsDeep() function merges objects recursively without filtering keys such as proto, constructor, and prototype, enabling modification of Object.prototype. This can lead to improper control over object prototype attributes, classified under CWE-1321. The vulnerability has a CVSS 3.1 base score of 7.3, indicating high severity with network attack vector, low attack complexity, no privileges or user interaction required, and impacts on confidentiality, integrity, and availability. The issue is resolved in version 2.0.5.
Potential Impact
An attacker can exploit this vulnerability remotely without authentication or user interaction to modify Object.prototype. This can result in data corruption, application logic manipulation, or denial of service, impacting confidentiality, integrity, and availability of affected systems using vulnerable versions of the library.
Mitigation Recommendations
Upgrade to phun-ky defaults-deep version 2.0.5 or later, where the vulnerability is fixed. Patch status is confirmed by the vendor advisory indicating the fix in 2.0.5. No other mitigation is specified.
CVE-2026-54737: CWE-1321: Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') in phun-ky defaults-deep
Description
### Impact A prototype pollution vulnerability exists in @phun-ky/defaults-deep prior to version 2.0.5. The library recursively merged user-supplied objects without filtering unsafe property names such as `__proto__`, `constructor`, and `prototype`. An attacker able to supply crafted input could cause properties to be written to `Object.prototype`, resulting in prototype pollution affecting all objects within the running process. Applications that pass untrusted input to `defaultsDeep()` may be impacted. Depending on how the application uses merged objects, this could lead to unexpected behavior, logic bypasses, denial of service, or other security issues. ### Patches This issue has been fixed in version 2.0.5. Users should upgrade to version 2.0.5 or later. The fix prevents unsafe prototype-related keys (`__proto__`, `constructor`, and `prototype`) from being processed during recursive merge operations and includes regression tests covering known prototype pollution vectors. ### Workarounds Users unable to upgrade should ensure that untrusted input is sanitized before being passed to `defaultsDeep()`. At a minimum, applications should reject or remove the following property names from all levels of user-controlled objects: - `__proto__` - `constructor` - `prototype` Upgrading to a patched version remains the recommended mitigation.
CVSS v3.1
Score 7.3high
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-54737 describes a prototype pollution vulnerability in the phun-ky defaults-deep library before version 2.0.5. The vulnerability arises because the defaultsDeep() function merges objects recursively without filtering keys such as proto, constructor, and prototype, enabling modification of Object.prototype. This can lead to improper control over object prototype attributes, classified under CWE-1321. The vulnerability has a CVSS 3.1 base score of 7.3, indicating high severity with network attack vector, low attack complexity, no privileges or user interaction required, and impacts on confidentiality, integrity, and availability. The issue is resolved in version 2.0.5.
Potential Impact
An attacker can exploit this vulnerability remotely without authentication or user interaction to modify Object.prototype. This can result in data corruption, application logic manipulation, or denial of service, impacting confidentiality, integrity, and availability of affected systems using vulnerable versions of the library.
Mitigation Recommendations
Upgrade to phun-ky defaults-deep version 2.0.5 or later, where the vulnerability is fixed. Patch status is confirmed by the vendor advisory indicating the fix in 2.0.5. No other mitigation is specified.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- GitHub_M
- Date Reserved
- 2026-06-15T23:07:33.233Z
- Cvss Version
- 3.1
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 6a6cf74bbf32cb7a3429480d
Added to database: 07/31/2026, 19:28:11 UTC
Last enriched: 07/31/2026, 19:34:50 UTC
Last updated: 07/31/2026, 21:28:21 UTC
Views: 2
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.