What is the CVSS score of CVE-2026-46509?

CVE-2026-46509 has a CVSS 3.1 base score of 8.2 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L. EPSS exploitation probability: 0.0%.

Which versions of @ranfdev/deepobj are affected by CVE-2026-46509?

The @ranfdev/deepobj npm package versions 1.0.2 and earlier contain a prototype pollution vulnerability that allows unauthenticated attackers to maliciously modify JavaScript object prototypes…. A patch is available.

How to fix or mitigate CVE-2026-46509?

Within 24 hours: Identify all applications and projects using @ranfdev/deepobj ≤1.0.2 via dependency scanning (npm audit, SBOM review). Within 7 days: Upgrade all instances to version 1.0.3 or later and validate in staging environments. Within 30 days: Confirm production deployments are patched, review application logs for suspicious prototype-related activity patterns, and implement input validation controls on any remaining user-supplied object property paths as defense-in-depth.

@ranfdev/deepobj CVE-2026-46509

EUVD-2026-32976 HIGH

Improperly Controlled Modification of Object Prototype Attributes (Prototype Pollution) (CWE-1321)

2026-05-14 https://github.com/ranfdev/deepobj

GHSA-x7q7-fchv-8h2j

Information Disclosure Prototype Pollution

8.2

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

8.2 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

Low

Lifecycle Timeline

Source Code Evidence Fetched

May 14, 2026 - 22:06 vuln.today

Analysis Generated

May 14, 2026 - 22:06 vuln.today

CVE Published

May 14, 2026 - 20:55 nvd

HIGH 8.2

DescriptionGitHub Advisory

Impact

Prototype pollution is possible when property paths contain __proto__/constructor/prototype. The property path must not be exposed as user input.

AnalysisAI

Prototype pollution in @ranfdev/deepobj npm package (versions ≤1.0.2) allows remote unauthenticated attackers to modify JavaScript object prototypes when property paths containing '__proto__', 'constructor', or 'prototype' are processed. The CVSS vector (AV:N/AC:L/PR:N/UI:N) indicates trivial exploitation against network-accessible applications, though real-world impact depends critically on whether user-controlled input is passed to property path parameters. EPSS data unavailable; not listed in CISA KEV. Publicly available exploit code exists (GitHub advisory GHSA-x7q7-fchv-8h2j). Vendor-released patch available in version 1.0.3.

Technical ContextAI

The @ranfdev/deepobj library is an npm package for deep object manipulation in JavaScript/Node.js applications (pkg:npm/@ranfdev_deepobj). The vulnerability stems from CWE-1321 (Improperly Controlled Modification of Object Prototype Attributes). When the library processes property paths without adequate sanitization, attackers can inject special JavaScript property names ('__proto__', 'constructor', 'prototype') to pollute the Object prototype chain. This is a classic JavaScript prototype pollution vulnerability where operations like object merging, deep assignment, or path-based property setting fail to validate or block reserved prototype-modifying keywords. The impact manifests as unauthorized modification of base object behavior affecting all object instances in the JavaScript runtime.

RemediationAI

Upgrade @ranfdev/deepobj to version 1.0.3 or later, which contains the vendor-released patch per GitHub advisory GHSA-x7q7-fchv-8h2j (https://github.com/ranfdev/deepobj/security/advisories/GHSA-x7q7-fchv-8h2j). Update package.json to specify "@ranfdev/deepobj": "^1.0.3" and run npm update or yarn upgrade. If immediate upgrade is not feasible, implement input validation to reject property paths containing the literal strings '__proto__', 'constructor', or 'prototype' before passing them to deepobj functions - note this workaround may break legitimate use cases requiring these property names. Alternatively, refactor code to avoid exposing property path parameters to any user-controlled input sources (HTTP requests, environment variables, external configuration files). Review application code to identify all call sites where user input flows into deepobj's property manipulation methods and apply allowlist-based path validation.