CVE-2026-54737: defaults-deep Privilege Escalation Flaw

CVE-2026-54737 Overview

CVE-2026-54737 is a prototype pollution vulnerability in the @phun-ky/defaults-deep npm package, a library that mimics lodash defaultsDeep while preserving arrays and eliminating the lodash dependency. Versions prior to 2.0.5 recursively merge user-supplied objects without filtering the __proto__, constructor, and prototype keys. An attacker who controls input passed to defaultsDeep() can write arbitrary properties onto Object.prototype, affecting every object in the running Node.js process. The maintainer released version 2.0.5 to filter unsafe keys during recursive merges. The weakness is classified under CWE-1321 (Improperly Controlled Modification of Object Prototype Attributes).

Critical Impact
Attackers can pollute Object.prototype in any Node.js application that passes untrusted input to defaultsDeep(), leading to logic tampering, authentication bypass, or denial of service.

Affected Products

@phun-ky/defaults-deep versions prior to 2.0.5
Node.js applications that invoke defaultsDeep() with untrusted input
Downstream packages transitively depending on the vulnerable library

Discovery Timeline

2026-07-31 - CVE-2026-54737 published to NVD
2026-07-31 - Last updated in NVD database

Technical Details for CVE-2026-54737

Vulnerability Analysis

The defaultsDeep() function recursively walks the source object and copies properties into the destination when the destination lacks a defined value. The pre-patch implementation in src/utils/merge-with.ts iterated all keys of the source without excluding JavaScript's prototype-related identifiers. When an attacker-controlled object contains a key named __proto__, constructor, or prototype, the recursive merge follows the reference to Object.prototype and assigns child properties there. Any object created afterward inherits the injected fields, which can flip authorization flags, override configuration values, or trigger unexpected code paths.

Root Cause

The root cause is missing input filtering during recursive object merging. The library treated __proto__ as an ordinary string key, allowing lookup and assignment to traverse into the prototype chain. This maps directly to CWE-1321.

Attack Vector

Exploitation requires that user-supplied JSON, query parameters, or configuration payloads reach a call site invoking defaultsDeep(). The attack is network-reachable and requires no authentication or user interaction when the vulnerable call sits behind a public API endpoint.

typescript

// Security patch in src/utils/merge-with.ts
// fix: Mitigate prototype pollution vulnerability
   return object as any;
 }
 
+const UNSAFE_KEYS = new Set<string>(['__proto__', 'constructor', 'prototype']);
+
 /**
  * Internal recursive merge implementation used by {@link mergeWith}.
  *

Source: GitHub Commit 807dba9. The fix introduces an UNSAFE_KEYS set that the recursive merge consults before assigning any property, blocking traversal into the prototype chain.

Detection Methods for CVE-2026-54737

Indicators of Compromise

HTTP request bodies or query strings containing the literal tokens __proto__, constructor.prototype, or prototype inside JSON structures.
Unexpected properties appearing on plain objects at runtime, such as isAdmin, polluted, or arbitrary flags that were never set by application code.
Error stacks referencing merge-with.ts from @phun-ky/defaults-deep versions below 2.0.5.

Detection Strategies

Perform Software Composition Analysis (SCA) on package-lock.json and yarn.lock to identify direct and transitive installs of @phun-ky/defaults-deep below 2.0.5.
Add a runtime guard using Object.freeze(Object.prototype) in staging to surface any code path that attempts prototype writes.
Enable WAF rules that inspect request bodies for prototype-pollution key patterns before they reach Node.js services.

Monitoring Recommendations

Log all inbound JSON payloads at API gateways and alert on payloads containing __proto__ or constructor.prototype keys.
Track Node.js process metrics for anomalous exception rates following deployment of user-facing endpoints that call defaultsDeep().
Review CI/CD dependency reports for advisory GHSA-mj3g-7xcc-x4vh on every build.

How to Mitigate CVE-2026-54737

Immediate Actions Required

Upgrade @phun-ky/defaults-deep to version 2.0.5 or later in every application and internal library.
Audit application source for direct calls to defaultsDeep() that accept unvalidated user input and add explicit key allowlists.
Rebuild and redeploy container images to ensure the patched dependency version is present in production runtimes.

Patch Information

The fix is available in release 2.0.5 via pull request #49. The patch adds an UNSAFE_KEYS set that blocks assignment to __proto__, constructor, and prototype during recursive merging. Review the GitHub Security Advisory GHSA-mj3g-7xcc-x4vh for the full disclosure.

Workarounds

Wrap calls to defaultsDeep() with a sanitizer that deletes __proto__, constructor, and prototype keys from input objects before invocation.
Freeze Object.prototype early in application bootstrap using Object.freeze(Object.prototype) to block writes at runtime.
Replace defaultsDeep() usage with structuredClone() combined with Object.create(null) destinations until the upgrade is deployed.

bash

# Upgrade to the patched version
npm install @phun-ky/defaults-deep@2.0.5

# Verify no vulnerable versions remain in the dependency tree
npm ls @phun-ky/defaults-deep

# Audit the project for known advisories
npm audit --production