Executive brief
deep-defaults is a Node.js library that recursively merges JavaScript objects with default values. A prototype pollution vulnerability allows attackers to inject malicious properties into the global Object prototype by passing specially crafted input, potentially leading to denial of service or remote code execution across applications using the library.
Technical details
The vulnerability is a prototype pollution flaw in the _deepDefaults() function (CWE-1321). The function recursively assigns properties from a source object to a destination object without validating whether properties are the Object's own properties or prototype chain properties. An unauthenticated attacker can supply a malicious payload containing "__proto__" as a property key to pollute the Object prototype. This affects versions 1.0.0 through 1.0.5. Once the prototype is polluted, all objects created afterward inherit the malicious properties, potentially enabling remote code execution or denial of service depending on how the polluted properties are used downstream in the application.
Affected products
- npm deep-defaults 1.0.0 through 1.0.5
Timeline
- 2022-05-24: disclosed
- 2021-05-25: other: NVD published