What is the CVSS score of CVE-2026-25047?

CVE-2026-25047 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Node.js are affected by CVE-2026-25047?

A critical vulnerability in Deephas (versions up to 1.0.7) allows attackers to manipulate application objects through prototype pollution, potentially enabling unauthorized access, data theft, or…. A patch is available.

Is there a public PoC exploit available for CVE-2026-25047?

Yes, a public proof-of-concept exploit is available for CVE-2026-25047. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate CVE-2026-25047?

Within 24 hours: Identify all systems running Deephas versions 1.0.7 or earlier and isolate them from production if possible; begin patch testing in a non-production environment. Within 7 days: Deploy patched Deephas version to all production systems following change management procedures; verify successful patching and test application functionality. Within 30 days: Complete audit of all Deephas instances across the organization; review logs for signs of exploitation between vulnerability disclosure and patch deployment.

Node.js CVE-2026-25047

HIGH

Improperly Controlled Modification of Object Prototype Attributes (Prototype Pollution) (CWE-1321)

2026-01-29 security-advisories@github.com

GHSA-2733-6c58-pf27

Node.js Deephas

8.8

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

8.8 HIGH

AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 22:00 vuln.today

PoC Detected

Feb 25, 2026 - 15:13 vuln.today

Public exploit code

Patch released

Feb 25, 2026 - 15:13 nvd

Patch available

CVE Published

Jan 29, 2026 - 22:15 nvd

HIGH 8.8

DescriptionGitHub Advisory

deepHas provides a test for the existence of a nested object key and optionally returns that key. A prototype pollution vulnerability exists in version 1.0.7 of the deephas npm package that allows an attacker to modify global object behavior. This issue was fixed in version 1.0.8.

AnalysisAI

Deephas versions up to 1.0.7 is affected by improperly controlled modification of object prototype attributes (prototype pollution) (CVSS 8.8).

Technical ContextAI

This vulnerability (CWE-1321: Improperly Controlled Modification of Object Prototype Attributes (Prototype Pollution)) affects Deephas. deepHas provides a test for the existence of a nested object key and optionally returns that key. A prototype pollution vulnerability exists in version 1.0.7 of the deephas npm package that allows an attacker to modify global object behavior. This issue was fixed in version 1.0.8.

RemediationAI

A vendor patch is available — apply it immediately. Fixed in version 1.0.8..

More in Node.js

View all

CVE-2024-41713 CRITICAL Emergency POC

9.1 Oct 21

A vulnerability in the NuPoint Unified Messaging (NPM) component of Mitel MiCollab through 9.8 SP1 FP2 (9.8.1.201) could

CVE-2024-55591 CRITICAL Emergency POC

9.8 Jan 14

FortiOS and FortiProxy contain an authentication bypass via the Node.js websocket module allowing unauthenticated remote

CVE-2023-44487 HIGH Act Now POC

7.5 Oct 10

Denial of service against HTTP/2 server implementations allows remote unauthenticated attackers to exhaust server resour

CVE-2014-7205 CRITICAL Act Now POC

10.0 Oct 08

Eval injection vulnerability in the internals.batch function in lib/batch.js in the bassmaster plugin before 1.5.2 for t

CVE-2025-59528 CRITICAL Act Now POC

10.0 Sep 22

Flowise version 3.0.5 contains a remote code execution vulnerability in the CustomMCP node. The mcpServerConfig paramete

CVE-2017-14849 HIGH Act Now POC

7.5 Sep 28

Node.js 8.5.0 before 8.6.0 allows remote attackers to access unintended files, because a change to ".." handling was inc

CVE-2017-5941 CRITICAL Emergency POC

9.8 Feb 09

An issue was discovered in the node-serialize package 0.0.4 for Node.js. Rated critical severity (CVSS 9.8), this vulner

CVE-2014-0224 HIGH Act Now POC

7.4 Jun 05

OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h does not properly restrict processing of ChangeCiph

CVE-2014-3744 HIGH Act Now POC

7.5 Oct 23

Directory traversal vulnerability in the st module before 0.2.5 for Node.js allows remote attackers to read arbitrary fi

CVE-2014-9566 HIGH Act Now POC

7.5 Mar 10

Multiple SQL injection vulnerabilities in the Manage Accounts page in the AccountManagement.asmx service in the Solarwin

CVE-2013-4660 MEDIUM This Month POC

6.8 Jun 28

The JS-YAML module before 2.0.5 for Node.js parses input without properly considering the unsafe !!js/function tag, whic

CVE-2016-2107 MEDIUM This Month POC

5.9 May 05

The AES-NI implementation in OpenSSL before 1.0.1t and 1.0.2 before 1.0.2h does not consider memory allocation during a

Same weakness CWE-1321 – Improperly Controlled Modification of Object Prototype Attributes (Prototype Pollution)

View all

CVE-2026-34621 HIGH POC

8.6

CVE-2024-56059 CRITICAL

9.8

CVE-2020-28271 CRITICAL POC

9.8

CVE-2023-38894 CRITICAL POC

9.8

CVE-2024-24292 CRITICAL POC

9.8

CVE-2023-26121 CRITICAL POC

10.0

CVE-2021-23449 CRITICAL POC

10.0

CVE-2024-39011 CRITICAL POC

9.8

CVE-2026-25047 vulnerability details – vuln.today

Back

Node.js CVE-2026-25047

Severity by source

CVSS VectorGitHub Advisory

Lifecycle Timeline

DescriptionGitHub Advisory

AnalysisAI

Technical ContextAI

RemediationAI

More in Node.js

Same weakness CWE-1321 – Improperly Controlled Modification of Object Prototype Attributes (Prototype Pollution)

Share

External POC / Exploit Code