@nevware21/ts-utils: Prototype Pollution in objDeepCopy/objCopyProps via for...in without hasOwnProperty

Description

The _copyProps function in lib/src/object/copy.ts uses for…in to iterate over source object properties without an Object.hasOwnProperty check, and does not filter dangerous keys (proto, constructor, prototype). This allows an attacker to pollute the prototype chain of all objects in the application.

Recommendation

Update the @nevware21/ts-utils package to the latest compatible version. Followings are version details:

• Affected version(s): <= 0.13.0
• Patched version(s): 0.14.0

References

• GHSA-x7j8-49r8-mr43
• CVE-2026-46681
• CWE-1321
• CAPEC-310
• OWASP 2021-A6

Related Issues

• lodash vulnerable to Prototype Pollution via array path bypass in `_.unset` and `_.omit` - lodash-es - CVE-2026-2950
• Parse Server vulnerable to schema poisoning via prototype pollution in deep copy - CVE-2026-32878
• lodash vulnerable to Prototype Pollution via array path bypass in `_.unset` and `_.omit` - lodash.unset - CVE-2026-2950
• lodash vulnerable to Prototype Pollution via array path bypass in `_.unset` and `_.omit` - lodash-amd - CVE-2026-2950

You might also like:

How to Secure your NodeJs Express Javascript Application - part 1

How to Secure your NodeJs Express Javascript Application - part 2

10 Secure Coding Best Practices to Follow in Every Project

Tags:

npm

@nevware21/ts-utils