CVE-2026-54737 — @phun-ky/defaults-deep Has a Prototype Pollution issue via Unsafe Recursive Property Merging
@phun-ky/defaults-deep is a library like lodash defaultsDeep with array preservation and no lodash dependency. Prior to 2.0.5, defaultsDeep() recursively merges user-supplied ob…
Published: 2026-07-31 · CVSS: 7.3 · CVSS 3.1
@phun-ky/defaults-deep is a library like lodash defaultsDeep with array preservation and no lodash dependency. Prior to 2.0.5, defaultsDeep() recursively merges user-supplied objects without filtering proto, constructor, and prototype, allowing properties to be written to Object.prototype. This issue is fixed in version 2.0.5.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7