@nevware21/ts-utils: Prototype Pollution in objDeepCopy/objCopyProps via for...in without hasOwnProperty

Description

The _copyProps function in lib/src/object/copy.ts uses for…in to iterate over source object properties without an Object.hasOwnProperty check, and does not filter dangerous keys (proto, constructor, prototype). This allows an attacker to pollute the prototype chain of all objects in the application.

Recommendation

Update the @nevware21/ts-utils package to the latest compatible version. Followings are version details:

• Affected version(s): <= 0.13.0
• Patched version(s): 0.14.0

References

• GHSA-x7j8-49r8-mr43
• CVE-2026-46681
• CWE-1321
• CAPEC-310
• OWASP 2021-A6

Related Issues

• scimPatch vulnerable to prototype pollution via unfiltered keys in patch - CVE-2026-48170
• jodit: Prototype pollution in Jodit via Jodit.modules.Helpers.set() - CVE-2026-55886
• @tmlmobilidade/utils has prototype pollution in its setValueAtPath - CVE-2026-45325
• @phun-ky/defaults-deep Has a Prototype Pollution issue via Unsafe Recursive Property Merging - CVE-2026-54737

You might also like:

How to Secure your NodeJs Express Javascript Application - part 1

How to Secure your NodeJs Express Javascript Application - part 2

10 Secure Coding Best Practices to Follow in Every Project

Tags:

npm

@nevware21/ts-utils