CVE-2026-54737: @phun ky/defaults deep @phun-ky/defaults-deep Has A Prototype Pollution Vulnerability
HIGHCVE-2026-54737 is a HIGH (CVSS 7.3) @phun-ky/defaults-deep has a prototype pollution vulnerability (CWE-1321: Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')) affecting @phun ky/defaults deep libraries in the npm ecosystem. The issue involves @phun-ky/defaults-deep has a prototype pollution issue via unsafe recursive property merging. Remediation is available by upgrading affected packages to version 2.0.5.
CVE-2026-54737 at a Glance
Security Impact
CVSS: 7.3
The security impact metrics below are parsed directly from the CVSS v3.1 vector string (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L).
How to Fix CVE-2026-54737
To remediate this vulnerability, upgrade all affected @phun ky/defaults deep dependencies to a patched release. Both direct and transitive dependencies should be checked, as frameworks or security libraries may pull in vulnerable versions transitively.
npm install @phun-ky/defaults-deep@2.0.5Run the following command in your project directory to verify that all resolved dependencies use the patched release:
npm ls @phun-ky/defaults-deepHow to Check if You Are Affected
To determine whether your Node.js application is affected by CVE-2026-54737, inspect your project dependencies using npm:
npm ls @phun-ky/defaults-deepAnalyze the terminal output to locate any version of @phun ky/defaults deep in your dependency tree. If any resolved version matches the vulnerable ranges listed in the table below (for example, versions earlier than 2.0.5), your application is affected.
Note: The npm ls @phun-ky/defaults-deep command inspects dependencies declared in your package.json and lockfile; it does not perform automated runtime dynamic scanning.
Technical Details
Vulnerability Mechanism & Technical Analysis
This vulnerability is classified under CWE-1321: Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution'), where the product receives input from an upstream component that specifies attributes that are to be initialized or updated in an object, but it does not properly control modifications of attributes of the object prototype. In @phun ky/defaults deep, software state validation or input boundaries are circumvented during processing. Review the official source advisory statement below for specific affected components, classes, and reproduction details.
Source Advisory Statement
CVE-2026-54737 Affected @phun ky/defaults deep Versions
1 component(s)| Product / Package | Ecosystem | Affected Versions | Fixed Version |
|---|---|---|---|
|
@phun-ky/defaults-deep
|
npm |
< 2.0.5
|
2.0.5
|
References
Frequently Asked Questions
What is CVE-2026-54737?
Which @phun ky/defaults deep versions are affected?
What version fixes CVE-2026-54737?
Is @phun-ky/defaults-deep affected?
What is the CVSS score of CVE-2026-54737?
What CWE is associated with CVE-2026-54737?
How can I check npm dependencies for CVE-2026-54737?
Machine-readable OSV JSON
OSV v1.5 Schema
{
"schema_version" : "1.4.0",
"id" : "GHSA-mj3g-7xcc-x4vh",
"modified" : "2026-07-31T17:49:09Z",
"published" : "2026-07-31T17:49:08Z",
"aliases" : [ "CVE-2026-54737" ],
"summary" : "@phun-ky/defaults-deep Has a Prototype Pollution issue via Unsafe Recursive Property Merging",
"details" : "### Impact\n\nA prototype pollution vulnerability exists in @phun-ky/defaults-deep prior to version 2.0.5.\n\nThe library recursively merged user-supplied objects without filtering unsafe property names such as `__proto__`, `constructor`, and `prototype`. An attacker able to supply crafted input could cause properties to be written to `Object.prototype`, resulting in prototype pollution affecting all objects within the running process.\n\nApplications that pass untrusted input to `defaultsDeep()` may be impacted. Depending on how the application uses merged objects, this could lead to unexpected behavior, logic bypasses, denial of service, or other security issues.\n\n### Patches\n\nThis issue has been fixed in version 2.0.5.\n\nUsers should upgrade to version 2.0.5 or later.\n\nThe fix prevents unsafe prototype-related keys (`__proto__`, `constructor`, and `prototype`) from being processed during recursive merge operations and includes regression tests covering known prototype pollution vectors.\n\n### Workarounds\n\nUsers unable to upgrade should ensure that untrusted input is sanitized before being passed to `defaultsDeep()`.\n\nAt a minimum, applications should reject or remove the following property names from all levels of user-controlled objects:\n\n- `__proto__`\n- `constructor`\n- `prototype`\n\nUpgrading to a patched version remains the recommended mitigation.",
"severity" : [ {
"type" : "CVSS_V3",
"score" : "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L"
} ],
"affected" : [ {
"package" : {
"ecosystem" : "npm",
"name" : "@phun-ky/defaults-deep"
},
"ranges" : [ {
"type" : "ECOSYSTEM",
"events" : [ {
"introduced" : "0"
}, {
"fixed" : "2.0.5"
} ]
} ]
} ],
"references" : [ {
"type" : "WEB",
"url" : "https://github.com/phun-ky/defaults-deep/security/advisories/GHSA-mj3g-7xcc-x4vh"
}, {
"type" : "WEB",
"url" : "https://github.com/phun-ky/defaults-deep/pull/49"
}, {
"type" : "WEB",
"url" : "https://github.com/phun-ky/defaults-deep/commit/807dba930f8718f9126cad59d949b8fd3539b059"
}, {
"type" : "PACKAGE",
"url" : "https://github.com/phun-ky/defaults-deep"
}, {
"type" : "WEB",
"url" : "https://github.com/phun-ky/defaults-deep/releases/tag/2.0.5"
} ],
"database_specific" : {
"cwe_ids" : [ "CWE-1321" ],
"severity" : "HIGH",
"github_reviewed" : true,
"github_reviewed_at" : "2026-07-31T17:49:08Z",
"nvd_published_at" : null
}
}