DEV Community

CVE Reports
CVE Reports

Posted on • Originally published at cvereports.com

CVE-2026-54737: CVE-2026-54737: Prototype Pollution in @phun-ky/defaults-deep

#security #cve #cybersecurity

CVE-2026-54737: Prototype Pollution in @phun-ky/defaults-deep

Vulnerability ID: CVE-2026-54737
CVSS Score: 7.3
Published: 2026-07-31

CVE-2026-54737 is a high-severity Prototype Pollution vulnerability in the @phun-ky/defaults-deep npm library prior to version 2.0.5. Due to unsafe recursive object merging, unauthenticated attackers can supply structured payloads that modify the properties of Object.prototype, compromising the runtime process state.

TL;DR

A prototype pollution vulnerability in the recursive merging function of @phun-ky/defaults-deep versions prior to 2.0.5 allows remote attackers to execute arbitrary modification of Object.prototype attributes via crafted inputs.

⚠️ Exploit Status: POC

Technical Details

  • CWE ID: CWE-1321
  • Attack Vector: Network (AV:N)
  • CVSS Score: 7.3 (High)
  • EPSS Status: Not Registered
  • Impact: Prototype Pollution (Privilege Escalation, DoS, RCE)
  • Exploit Status: PoC Available
  • KEV Status: Not Listed

Affected Systems

  • Node.js runtime environments using @phun-ky/defaults-deep dependency
  • @phun-ky/defaults-deep: < 2.0.5 (Fixed in: 2.0.5)

Code Analysis

Commit: 807dba9

Fix prototype pollution vulnerability by adding UNSAFE_KEYS blocklist of 'proto', 'constructor', and 'prototype' properties during baseMerge iteration.

Mitigation Strategies

  • Upgrade @phun-ky/defaults-deep to version 2.0.5 or above
  • Implement structural deep-sanitization recursive functions on all input middleware
  • Enforce strict prototype freezing at the initialization stage of Node.js services

Remediation Steps:

  1. Run npm install @phun-ky/defaults-deep@2.0.5 inside project workspaces
  2. Incorporate input validation schemas such as AJV or Joi to reject properties named proto, constructor, and prototype
  3. Deploy custom Express body-parser middleware to strip dangerous keys before merging operations

References

Read the full report for CVE-2026-54737 on our website for more details including interactive diagrams and full exploit analysis.

Top comments (0)