Executive brief
phun-ky/defaults-deep is a software library used by developers to merge data objects while preserving array structures. A security flaw in the library allows attackers to inject malicious data that modifies the fundamental behavior of all objects within a running application. This can lead to application crashes, unauthorized access to data, or the bypassing of security checks.
Technical details
A prototype pollution vulnerability (CWE-1321) exists in the defaultsDeep() and mergeWith() functions of the @phun-ky/defaults-deep library. The vulnerability stems from the recursive merging of user-supplied objects without proper filtering of sensitive keys such as __proto__, constructor, and prototype. An attacker can exploit this by providing a specially crafted JSON payload that writes properties to Object.prototype, affecting all objects in the Node.js process. This can result in logic bypasses, denial of service, or potentially remote code execution depending on the application context. The issue is resolved in version 2.0.5 by explicitly skipping these unsafe keys during recursion.
Affected products
- phun-ky defaults-deep < 2.0.5
Timeline
- 2026-06-08: patched: Fix committed and version 2.0.5 released.
- 2026-06-09: advisory: GitHub Security Advisory GHSA-mj3g-7xcc-x4vh published.
- 2026-07-31: disclosed: CVE-2026-54737 published to NVD.