Phun-ky vulnerabilities

🔔 Create alert RSS

Published CVEs affecting Phun-ky products: 1 record(s), with severity, exploitation and fixes.

Defaults-deep 1

Exploited only (KEV) →

CVE-2026-54737 High · 7.3 CWE-1321 Jul 31, 2026

@phun-ky/defaults-deep Has a Prototype Pollution issue via Unsafe Recursive Property Merging

@phun-ky/defaults-deep is a library like lodash defaultsDeep with array preservation and no lodash dependency. Prior to 2.0.5, defaultsDeep() recursively merges user-supplied objects without filtering proto, constructor, and prototype, allowing properties to be written to Object.prototype. This issue is fixed in version 2.0.5.