CVE-2021-25944

Vulnerability

The NPM package deep-defaults versions 1.0.0 through 1.0.5 contains a prototype pollution vulnerability in the _deepDefaults() function. The function fails to validate the type of the source object before assigning properties, allowing an attacker to pollute the prototype chain via the __proto__ property [1][4].

Exploitation

An attacker can exploit this by providing a crafted object with a __proto__ property to the deepDefaults() function. No authentication is required if the function processes user-supplied input. The attacker simply passes a malicious object, e.g., {"__proto__": {"polluted": true}}, which results in prototype pollution [1].

Impact

Successful exploitation leads to denial of service (e.g., unexpected behavior) and can potentially enable remote code execution if the attacker can influence subsequent operations that rely on object properties [1][3]. The pollution affects all objects inheriting from the polluted prototype, escalating the attack's scope.

Mitigation

No official fix has been released; the repository is not actively maintained [2]. Users should avoid using deep-defaults or migrate to an alternative package that handles object merging safely. Monitor for any updates or patches in the future.