Prototype Pollution in cookiex/deep

CRITICAL 9.8CVE-2021-23442 · GHSA-92v9-xh2q-fq9f · SNYK-JS-COOKIEXDEEP-1582793 · Published 17/09/2021 · updated 17/06/2026

In short

CVE-2021-23442 is a CRITICAL (CVSS 9.8) vulnerability affecting cookiex-deep (cookiex-deep project), @cookiex/deep.
Chance of exploitation in the next 30 days (EPSS): 1.6%, higher than 75.8% of all vulnerabilities.
Fix: update to 0.0.6, 0.0.7 or later.

Package	Affected versions	Patched versions
cookiex-deep cookiex-deep_project	`< 0.0.6`	`0.0.6`
@cookiex/deep npm	`< 0.0.7`	`0.0.7`

Description

The npm @cookiex/deep package before version 0.0.7 has a prototype pollution vulnerability. The global proto object can be polluted using the proto object.

NVD description

This affects all versions of package @cookiex/deep. The global proto object can be polluted using the __proto__ object.

References

nvd.nist.gov/vuln/detail/CVE-2021-23442 · ADVISORY
tony-tsx/cookiex-deep · WEB
tony-tsx/cookiex-deep commit b5bea2b · WEB
tony-tsx/cookiex-deep · PACKAGE
snyk.io/vuln/SNYK-JS-COOKIEXDEEP-1582793 · WEB

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free