Description
The _copyProps function in lib/src/object/copy.ts uses for…in to iterate over source object properties without an Object.hasOwnProperty check, and does not filter dangerous keys (proto, constructor, prototype). This allows an attacker to pollute the prototype chain of all objects in the application.
Recommendation
Update the @nevware21/ts-utils package to the latest compatible version. Followings are version details:
- Affected version(s): <= 0.13.0
- Patched version(s): 0.14.0
References
Could your website be exposed too?
SmartScanner can check your website for @nevware21/ts-utils: Prototype Pollution in objDeepCopy/objCopyProps via for...in without hasOwnProperty and gives you actionable findings to investigate.
Start a free scanRelated Issues
- scimPatch vulnerable to prototype pollution via unfiltered keys in patch - CVE-2026-48170
- jodit: Prototype pollution in Jodit via Jodit.modules.Helpers.set() - CVE-2026-55886
- @tmlmobilidade/utils has prototype pollution in its setValueAtPath - CVE-2026-45325
- @phun-ky/defaults-deep Has a Prototype Pollution issue via Unsafe Recursive Property Merging - CVE-2026-54737
You might also like:
See something that needs correcting? Let us knowUpdated May 21, 2026