@ranfdev/deepobj has a Prototype Pollution vulnerability

Description

Prototype pollution is possible when property paths contain __proto__/constructor/prototype. The property path must not be exposed as user input.

Recommendation

Update the @ranfdev/deepobj package to the latest compatible version. Followings are version details:

• Affected version(s): <= 1.0.2
• Patched version(s): 1.0.3

References

• GHSA-x7q7-fchv-8h2j
• CVE-2026-46509
• CWE-1321
• CAPEC-310
• OWASP 2021-A6

Related Issues

• Velocity.js has a Prototype Pollution vulnerability through #set path assignment - CVE-2026-44966
• LangSmith Client SDKs has Prototype Pollution in langsmith-sdk via Incomplete `__proto__` Guard in Internal lodash `set( - CVE-2026-40190
• CSVTOJSON has a prototype pollution vulnerability - CVE-2025-57350
• Axios has prototype pollution read-side gadgets in HTTP adapter that allow credential injection and request hijacking - CVE-2026-42264

You might also like:

Exploiting Server Version Disclosure

How do hackers hack websites?

CSRF, XXE, and 12 Other Security Acronyms Explained

Tags:

npm

@ranfdev/deepobj