Answer in brief
CVE-2026-54737 records a High severity security vulnerability in @phun-ky/defaults-deep Has a Prototype Pollution issue via Unsafe Recursive Property Merging. The source record does not mark it as known exploited. 1 affected package is mapped in the feed.
Answer in brief
CVE-2026-54737 records a High severity security vulnerability in @phun-ky/defaults-deep Has a Prototype Pollution issue via Unsafe Recursive Property Merging. The source record does not mark it as known exploited. 1 affected package is mapped in the feed.
Update @phun-ky/defaults-deep to 2.0.5 if you use the affected versions. Test the change in a non-production environment first.
Local check
hol-guard supply-chain scanVulnerability describes the vulnerability class recorded for this advisory. The current record does not mark CVE-2026-54737 as known exploited; continue to monitor the source for status changes. The feed includes package mappings that can be checked against lockfiles and deployed manifests.
| Package | Affected range | Fixed version |
|---|---|---|
| @phun-ky/defaults-deepnpm | <2.0.5 | 2.0.5 |
Fixed versions are reported by the source feed; confirm compatibility before updating.
Reported by GitHub Security Advisories (ghsa).
CVE-2026-54737 records a High severity security vulnerability in @phun-ky/defaults-deep Has a Prototype Pollution issue via Unsafe Recursive Property Merging. The source record does not mark it as known exploited. 1 affected package is mapped in the feed.
The source record does not mark it as known exploited.
Check lockfiles and deployed manifests for @phun-ky/defaults-deep.
HOL Guard can help your team review package activity against supported protection paths.
Explore HOL GuardUpdate @phun-ky/defaults-deep to 2.0.5 if you use the affected versions. Test the change in a non-production environment first.
Local check
hol-guard supply-chain scanVulnerability describes the vulnerability class recorded for this advisory. The current record does not mark CVE-2026-54737 as known exploited; continue to monitor the source for status changes. The feed includes package mappings that can be checked against lockfiles and deployed manifests.
| Package | Affected range | Fixed version |
|---|---|---|
| @phun-ky/defaults-deepnpm | <2.0.5 | 2.0.5 |
Fixed versions are reported by the source feed; confirm compatibility before updating.
Reported by GitHub Security Advisories (ghsa).
CVE-2026-54737 records a High severity security vulnerability in @phun-ky/defaults-deep Has a Prototype Pollution issue via Unsafe Recursive Property Merging. The source record does not mark it as known exploited. 1 affected package is mapped in the feed.
The source record does not mark it as known exploited.
Check lockfiles and deployed manifests for @phun-ky/defaults-deep.
HOL Guard can help your team review package activity against supported protection paths.
Explore HOL Guard### Impact A prototype pollution vulnerability exists in @phun-ky/defaults-deep prior to version 2.0.5. The library recursively merged user-supplied objects without filtering unsafe property names such as `__proto__`, `constructor`, and `prototype`. An attacker able to supply crafted input could cause properties to be written to `Object.prototype`, resulting in prototype pollution affecting all objects within the running process. Applications that pass untrusted input to `defaultsDeep()` may be impacted. Depending on how the application uses merged objects, this could lead to unexpected behavior, logic bypasses, denial of service, or other security issues. ### Patches This issue has been fixed in version 2.0.5. Users should upgrade to version 2.0.5 or later. The fix prevents unsafe prototype-related keys (`__proto__`, `constructor`, and `prototype`) from being processed during recursive merge operations and includes regression tests covering known prototype pollution vectors. ### Workarounds Users unable to upgrade should ensure that untrusted input is sanitized before being passed to `defaultsDeep()`. At a minimum, applications should reject or remove the following property names from all levels of user-controlled objects: - `__proto__` - `constructor` - `prototype` Upgrading to a patched version remains the recommended mitigation.
### Impact A prototype pollution vulnerability exists in @phun-ky/defaults-deep prior to version 2.0.5. The library recursively merged user-supplied objects without filtering unsafe property names such as `__proto__`, `constructor`, and `prototype`. An attacker able to supply crafted input could cause properties to be written to `Object.prototype`, resulting in prototype pollution affecting all objects within the running process. Applications that pass untrusted input to `defaultsDeep()` may be impacted. Depending on how the application uses merged objects, this could lead to unexpected behavior, logic bypasses, denial of service, or other security issues. ### Patches This issue has been fixed in version 2.0.5. Users should upgrade to version 2.0.5 or later. The fix prevents unsafe prototype-related keys (`__proto__`, `constructor`, and `prototype`) from being processed during recursive merge operations and includes regression tests covering known prototype pollution vectors. ### Workarounds Users unable to upgrade should ensure that untrusted input is sanitized before being passed to `defaultsDeep()`. At a minimum, applications should reject or remove the following property names from all levels of user-controlled objects: - `__proto__` - `constructor` - `prototype` Upgrading to a patched version remains the recommended mitigation.