@nevware21/ts-utils: Prototype Pollution in objDeepCopy/objCopyProps via for...in without hasOwnProperty

Description

The _copyProps function in lib/src/object/copy.ts uses for…in to iterate over source object properties without an Object.hasOwnProperty check, and does not filter dangerous keys (proto, constructor, prototype). This allows an attacker to pollute the prototype chain of all objects in the application.

Recommendation

Update the @nevware21/ts-utils package to the latest compatible version. Followings are version details:

• Affected version(s): <= 0.13.0
• Patched version(s): 0.14.0

References

• GHSA-x7j8-49r8-mr43
• CVE-2026-46681
• CWE-1321
• CAPEC-310
• OWASP 2021-A6

Related Issues

• Axios: Invisible JSON Response Tampering via Prototype Pollution Gadget in `parseReviver` - CVE-2026-42044
• Axios: XSRF Token Cross-Origin Leakage via Prototype Pollution Gadget in `withXSRFToken` Boolean Coercion - CVE-2026-42042
• Axios: Header Injection via Prototype Pollution - CVE-2026-42035
• seroval Affected by Prototype Pollution via JSON Deserialization - CVE-2026-23736

You might also like:

How to Secure your NodeJs Express Javascript Application - part 1

How to Secure your NodeJs Express Javascript Application - part 2

10 Secure Coding Best Practices to Follow in Every Project

Tags:

npm

@nevware21/ts-utils