# CVE-2025-8083: Vuetify prototype pollution in mergeDeep utility

Source: https://junglewise.ai/threats/cve-2025-8083-vuetify-prototype-pollution-in-preset-configuration  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2025-12-12. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2025-8083 · Severity: high · CVSS 8.6 · Published 2025-12-12

Vuetify is a widely-used Vue.js UI component framework for building web applications. A prototype pollution vulnerability in the mergeDeep utility function allows attackers to inject malicious preset configuration options that corrupt all JavaScript objects in the application, potentially causing denial of service, data theft, or unauthorized access. The vulnerability is particularly severe in applications using server-side rendering, where a single malicious request could compromise the entire server process.

Technologies: [vuetify (npm)](https://junglewise.ai/threats/technologies/vuetify). Vendors: [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2025-8083 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2025-8083 being exploited in the wild.

**How severe is CVE-2025-8083?** High severity, with a CVSS score of 8.6, published 12 December 2025.

**Which products and versions are affected?** vuetify (npm) SEMVER:introduced=2.2.0-beta.2,fixed=3.0.0-alpha.10.

**Is there a fix for CVE-2025-8083?** Yes. vuetify (npm): upgrade to 3.0.0-alpha.10 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2025-8083 attacked?** It is attacked over the network.

**Am I affected by CVE-2025-8083?** Check whether you run vuetify (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- vuetify (npm): upgrade to 3.0.0-alpha.10 or later

  ```sh
  npm install vuetify@3.0.0-alpha.10
  ```


## Technical details

The vulnerability is a prototype pollution flaw (CWE-1321) in Vuetify's mergeDeep utility function, which is invoked during framework initialization to merge user-provided preset options with default configuration. An attacker can craft a malicious preset object containing __proto__ properties that pollute the JavaScript prototype chain, injecting arbitrary properties into all objects created during the application lifecycle. No authentication or user interaction is required; the attack is triggered by passing the malicious options to the Vuetify constructor. The impact includes resource exhaustion, denial of service, unauthorized data access, and potential remote code execution depending on application logic. Version 2.x is end-of-life and will not receive patches; users must either upgrade to version 3.0.0-alpha.10 or later, or engage commercial support (HeroDevs NES v2.7.4+) for post-EOL security updates.

## Affected products

- Vuetify vuetify >=2.2.0-beta.2, <3.0.0-alpha.10

## Identifiers

- CVE-2025-8083
- GHSA-3jp5-5f8r-q2wg

## Timeline

- 2025-12-12: disclosed: Published by GitHub Security Advisory
- 2025-12-12: advisory: CVE-2025-8083 assigned

## References

- [https://codepen.io/herodevs/pen/RNWoaQM/f1f4ccc7e6a307c2a8c36d948ba14755](https://codepen.io/herodevs/pen/RNWoaQM/f1f4ccc7e6a307c2a8c36d948ba14755)
- [https://github.com/vuetifyjs/vuetify](https://github.com/vuetifyjs/vuetify)
- [https://www.herodevs.com/vulnerability-directory/cve-2025-8083](https://www.herodevs.com/vulnerability-directory/cve-2025-8083)

## Related threats

- [Vuetify VDatePicker cross-site scripting](https://junglewise.ai/threats/cve-2025-8082-vuetify-vdatepicker-cross-site-scripting)
- [Vuetify VCalendar cross-site scripting in eventName function](https://junglewise.ai/threats/cve-2022-25873-vuetify-vcalendar-cross-site-scripting-in-eventname-function)