CVE Intelligence

Phun-ky Defaults-deep vulnerabilities

🔔 Create alert RSS Version checker

Published CVEs affecting Phun-ky Defaults-deep: 1 record(s), with affected versions and fixes.

CVE-2026-54737 High · 7.3 CWE-1321 Jul 31, 2026
@phun-ky/defaults-deep Has a Prototype Pollution issue via Unsafe Recursive Property Merging
@phun-ky/defaults-deep is a library like lodash defaultsDeep with array preservation and no lodash dependency. Prior to 2.0.5, defaultsDeep() recursively merges user-supplied objects without filtering proto, constructor, and prototype, allowing properties to be written to Object.prototype. This issue is fixed in version 2.0.5.