CVE-2026-46509: ranfdev deepobj prototype pollution

Executive brief

@ranfdev/deepobj is a JavaScript library used for manipulating complex data objects. A security flaw allows an attacker to inject malicious properties into the application's core object structure. This can lead to application crashes or unauthorized changes to how the software behaves, potentially affecting all users of the service.

Technical details

A prototype pollution vulnerability (CWE-1321) exists in @ranfdev/deepobj versions up to and including 1.0.2. The vulnerability occurs when the library processes property paths containing sensitive keys such as '__proto__', 'constructor', or 'prototype' without proper validation. An attacker can exploit this by providing a specially crafted property path as input, allowing them to modify the global Object prototype. This can result in a denial of service or potentially remote code execution depending on the application's environment. The issue is fixed in version 1.0.3.

Affected products

• ranfdev @ranfdev/deepobj <= 1.0.2

Timeline

• 2026-05-09: disclosed: Vulnerability reported to vendor
• 2026-05-14: advisory: GitHub Advisory published
• 2026-05-28: other: NVD published CVE-2026-46509
• 2026-06-09: other: Advisory updated

References

• https://api.github.com/users/0xBassia
• https://github.com/0xBassia
• https://api.github.com/users/0xBassia/gists%7B/gist_id%7D
• https://api.github.com/users/0xBassia/repos
• https://avatars.githubusercontent.com/u/12531007?v=4
• https://api.github.com/users/0xBassia/events%7B/privacy%7D