Prototype Pollution in deep-extend

CRITICAL 9.8CVE-2018-3750 · GHSA-hr2v-3952-633q · Published 03/07/2018 · updated 17/06/2026

In short

CVE-2018-3750 is a CRITICAL (CVSS 9.8) vulnerability affecting deep extend (deep extend project), deep-extend.
Chance of exploitation in the next 30 days (EPSS): 2.1%, higher than 82.2% of all vulnerabilities.
Fix: update to 0.5.1 or later.

Package	Affected versions	Patched versions
deep extend deep_extend_project	`≤ 0.5.0`	No fix yet
deep-extend npm	`< 0.5.1`	`0.5.1`

Description

Versions of deep-extend before 0.5.1 are vulnerable to prototype pollution.

Recommendation

Update to version 0.5.1 or later.

NVD description

The utilities function in all versions <= 0.5.0 of the deep-extend node module can be tricked into modifying the prototype of Object when the attacker can control part of the structure passed to this function. This can let an attacker add or modify existing properties that will exist on all objects.

References

nvd.nist.gov/vuln/detail/CVE-2018-3750 · ADVISORY
unclechu/node-deep-extend commit 9423fae · WEB
hackerone.com/reports/311333 · WEB
GitHub Advisory GHSA-hr2v-3952-633q · ADVISORY
npmjs.com/advisories/612 · WEB

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free