← All advisories

Critical severity9.8NVD Advisory· Published Feb 1, 2019· Updated Jun 17, 2026

CVE-2018-16486

CVE-2018-16486

Description

A prototype pollution vulnerability was found in defaults-deep <=0.2.4 that would allow a malicious user to inject properties onto Object.prototype.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected packages

Versions sourced from the GitHub Security Advisory.

Package	Affected versions	Patched versions
defaults-deepnpm	<= 0.2.4	—

Affected products

3

Defaults Deep Project/Defaults Deep
cpe:2.3:a:defaults-deep_project:defaults-deep:*:*:*:*:*:node.js:*:*
Range: <=0.2.4
ghsa-coords
pkg:npm/defaults-deep
Range: <= 0.2.4
HackerOne/defaults-deepv5
Range: <=0.2.4

Patches

Vulnerability mechanics

References

4

hackerone.com/reports/380878nvdExploitIssue TrackingThird Party AdvisoryWEB
github.com/advisories/GHSA-pjxw-22xf-6pwcghsaADVISORY
nvd.nist.gov/vuln/detail/CVE-2018-16486ghsaADVISORY
www.npmjs.com/advisories/778ghsaWEB

News mentions

0

No linked articles in our index yet.