p PatchFirst

PatchFirst · Latest vulnerabilities

@phun-ky/defaults-deep vulnerabilities

Vulnerabilities published for @phun-ky/defaults-deep in the last 30 days: 0. Listed in the KEV catalogue: 0.

RSS ↗ JSON ↗
Filter vulnerabilities
Clear filters

Vulnerability: 1

  1. CVE-2026-54737

    High · CVSS 7.3EPSS 0.46%Fix available

    @phun-ky/defaults-deep Has a Prototype Pollution issue via Unsafe Recursive Property Merging

    @phun-ky/defaults-deep is a library like lodash defaultsDeep with array preservation and no lodash dependency. Prior to 2.0.5, defaultsDeep() recursively merges user-supplied objects without filtering proto, constructor, and prototype, allowing properties to be written to Object.prototype. This issue is fixed in version 2.0.5.

    @phun-ky/defaults-deepNode.js
    • Update to 2.0.5
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

Check your server

Check your installed stack and versions against the current vulnerability feeds.

Check your server →