@ranfdev/deepobj has a Prototype Pollution vulnerability

Description

Prototype pollution is possible when property paths contain __proto__/constructor/prototype. The property path must not be exposed as user input.

Recommendation

Update the @ranfdev/deepobj package to the latest compatible version. Followings are version details:

Affected version(s): <= 1.0.2
Patched version(s): 1.0.3

References

GHSA-x7q7-fchv-8h2j
CVE-2026-46509
CWE-1321
CAPEC-310
OWASP 2021-A6

Could your website be exposed too?

SmartScanner can check your website for @ranfdev/deepobj has a Prototype Pollution vulnerability and gives you actionable findings to investigate.

Start a free scan

Related Issues

Velocity.js has a Prototype Pollution vulnerability through #set path assignment - CVE-2026-44966
LangSmith Client SDKs has Prototype Pollution in langsmith-sdk via Incomplete `__proto__` Guard in Internal lodash `set( - CVE-2026-40190
CSVTOJSON has a prototype pollution vulnerability - CVE-2025-57350
Axios has prototype pollution read-side gadgets in HTTP adapter that allow credential injection and request hijacking - CVE-2026-42264

Exploiting Server Version Disclosure

How do hackers hack websites?

CSRF, XXE, and 12 Other Security Acronyms Explained

See something that needs correcting? Let us knowUpdated June 09, 2026