Prototype Pollution in defaults-deep

CRITICAL 9.8CVE-2018-16486 · GHSA-pjxw-22xf-6pwc · Published 01/02/2019 · updated 17/06/2026

In short

CVE-2018-16486 is a CRITICAL (CVSS 9.8) vulnerability affecting defaults-deep (defaults-deep project), defaults-deep.
Chance of exploitation in the next 30 days (EPSS): 1.5%, higher than 74.0% of all vulnerabilities.
No patched version is listed yet: follow the vendor's advisory in References.

Package	Affected versions	Patched versions
defaults-deep defaults-deep_project	`≤ 0.2.4`	No fix yet
defaults-deep npm	`≤ 0.2.4`	No fix yet

Description

All versions of defaults-deep are vulnerable to prototype pollution. Provided certain input defaults-deep can add or modify properties of the Object prototype. These properties will be present on all objects.

Recommendation

As no patch is currently available for this vulnerability it is our recommendation to select another module that can provide this functionality.

NVD description

A prototype pollution vulnerability was found in defaults-deep <=0.2.4 that would allow a malicious user to inject properties onto Object.prototype.

References

nvd.nist.gov/vuln/detail/CVE-2018-16486 · ADVISORY
hackerone.com/reports/380878 · WEB
GitHub Advisory GHSA-pjxw-22xf-6pwc · ADVISORY
jonschlinkert/defaults-deep · PACKAGE
npmjs.com/advisories/778 · WEB

More vulnerabilities in defaults-deep

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

defaults-deep

defaults-deep_project

≤ 0.2.4

No fix yet

defaults-deep

npm

≤ 0.2.4

No fix yet

Description

Recommendation

As no patch is currently available for this vulnerability it is our recommendation to select another module that can provide this functionality.

NVD description

A prototype pollution vulnerability was found in defaults-deep <=0.2.4 that would allow a malicious user to inject properties onto Object.prototype.