deep-defaults vulnerable to prototype pollution

Description

Prototype pollution vulnerability in ‘deep-defaults’ versions 1.0.0 through 1.0.5 allows attacker to cause a denial of service and may lead to remote code execution.

Recommendation

No fix is available yet. Followings are affected versions:

>= 1.0.0, <= 1.0.5

References

GHSA-h6xg-rg33-9mf4
web.archive.org
CVE-2021-25944
CWE-1321
CAPEC-310
OWASP 2021-A6

Could your website be exposed too?

SmartScanner can check your website for deep-defaults vulnerable to prototype pollution and gives you actionable findings to investigate.

Start a free scan

Related Issues

deep-object-diff vulnerable to Prototype Pollution - CVE-2022-41713
Prototype Pollution in deep-override - CVE-2021-25941
mootools-more vulnerable to prototype pollution - CVE-2021-20088
jszip Vulnerable to Prototype Pollution - CVE-2021-23413

How to Secure your NodeJs Express Javascript Application - part 1

How to Secure your NodeJs Express Javascript Application - part 2

10 Secure Coding Best Practices to Follow in Every Project

See something that needs correcting? Let us knowUpdated April 22, 2024