High severity7.3OSV Advisory· Published Jul 31, 2026· Updated Sep 10, 2026
CVE-2026-54737
CVE-2026-54737
Description
@phun-ky/defaults-deep is a library like lodash defaultsDeep with array preservation and no lodash dependency. Prior to 2.0.5, defaultsDeep() recursively merges user-supplied objects without filtering proto, constructor, and prototype, allowing properties to be written to Object.prototype. This issue is fixed in version 2.0.5.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
@phun-ky/defaults-deepnpm | < 2.0.5 | 2.0.5 |
Affected products
22.0.4, 2.0.3, 2.0.2, …+ 1 more
- (no CPE)range: 2.0.4, 2.0.3, 2.0.2, …
- (no CPE)range: <2.0.5
Patches
Vulnerability mechanics
References
5- github.com/advisories/GHSA-mj3g-7xcc-x4vhghsaADVISORY
- github.com/phun-ky/defaults-deep/commit/807dba930f8718f9126cad59d949b8fd3539b059nvdWEB
- github.com/phun-ky/defaults-deep/pull/49nvdWEB
- github.com/phun-ky/defaults-deep/releases/tag/2.0.5nvdWEB
- github.com/phun-ky/defaults-deep/security/advisories/GHSA-mj3g-7xcc-x4vhnvdWEB
News mentions
0No linked articles in our index yet.