Executive brief
deep-extend is a widely-used Node.js library for merging and extending JavaScript objects. A prototype pollution vulnerability allows attackers to modify the base Object prototype through specially crafted input, potentially enabling arbitrary code execution or bypassing security checks across any application using the library. Versions before 0.5.1 are affected; immediate upgrade is required to prevent exploitation.
Technical details
The deep-extend library versions before 0.5.1 are vulnerable to prototype pollution (CWE-20), a class of vulnerability where an attacker can inject properties into Object.prototype through recursive object merging without proper validation. The vulnerability exists in the core deep-extend.js library code used for merging nested objects. An attacker with network access can supply malicious input containing __proto__ or constructor.prototype keys to pollute the prototype chain. Once polluted, the modified prototype affects all objects in the application, potentially allowing privilege escalation, authentication bypass, or remote code execution. A patch is available in version 0.5.1 and later.
Affected products
- deep-extend deep-extend before 0.5.1
Timeline
- 2018-10-09: disclosed
- 2018-10-09: patched: version 0.5.1 released with fix