Which versions of @nevware21/ts-utils are affected by CVE-2026-46681?

@nevware21/ts-utils versions 0.13.0 and earlier contain a prototype pollution vulnerability allowing attackers to corrupt the JavaScript Object prototype through specially crafted JSON input.. A patch is available.

How to fix or mitigate CVE-2026-46681?

Within 24 hours: Identify all usages of @nevware21/ts-utils in the codebase and document current versions deployed. Within 7 days: Monitor vendor advisories for patch availability; if released, upgrade to the patched version immediately; otherwise, implement input validation to block __proto__ keys in JSON before processing through objDeepCopy or objCopyProps functions. Within 30 days: Complete security regression testing on all affected systems and evaluate alternative utility libraries if patches remain unavailable.

@nevware21/ts-utils CVE-2026-46681

HIGH

Improperly Controlled Modification of Object Prototype Attributes (Prototype Pollution) (CWE-1321)

2026-05-21 https://github.com/nevware21/ts-utils

GHSA-x7j8-49r8-mr43

Information Disclosure Prototype Pollution

Lifecycle Timeline

Source Code Evidence Fetched

May 21, 2026 - 22:31 vuln.today

Analysis Generated

May 21, 2026 - 22:31 vuln.today

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

1 npm packages depend on @nevware21/ts-utils (1 direct, 0 indirect)

Ecosystem-wide dependent count for version 0.14.0.

DescriptionCVE.org

Summary

The _copyProps function in lib/src/object/copy.ts uses for...in to iterate over source object properties without an Object.hasOwnProperty check, and does not filter dangerous keys (__proto__, constructor, prototype). This allows an attacker to pollute the prototype chain of all objects in the application.

Details

In _copyProps() (copy.ts lines 186-191), the code iterates all enumerable properties including inherited ones and dangerous keys like __proto__. Any object with a __proto__ key (e.g., from untrusted JSON input) will overwrite the target's prototype.

PoC

const malicious = JSON.parse('{"__proto__": {"polluted": true}}');
objDeepCopy(malicious);
console.log({}.polluted); // true

Suggested Fix

Add objHasOwnProperty check and filter __proto__, constructor, prototype keys.

AnalysisAI

Prototype pollution in @nevware21/ts-utils versions <= 0.13.0 allows attackers to corrupt the global Object prototype by passing crafted JSON containing a __proto__ key to objDeepCopy or objCopyProps. The flaw resides in the _copyProps helper, which iterates source properties with for...in without hasOwnProperty filtering and does not block dangerous keys. Publicly available exploit code exists via the vendor's GHSA proof-of-concept, though no public exploit identified at time of analysis beyond the disclosure PoC, and no KEV listing.

Technical ContextAI

@nevware21/ts-utils is an npm-published TypeScript utility library providing helpers such as objDeepCopy and objCopyProps for cloning and merging objects. The root cause is CWE-1321 (Improperly Controlled Modification of Object Prototype Attributes, a.k.a. Prototype Pollution): in lib/src/object/copy.ts the _copyProps function (lines 186-191) walks enumerable properties via for...in, which traverses inherited keys as well as the special __proto__ accessor, and assigns them onto the destination object. When the source is parsed from untrusted JSON, JSON.parse produces an own __proto__ data property whose assignment mutates Object.prototype, propagating the pollutant to every object in the runtime. The CPE identifier pkg:npm/@nevware21_ts-utils confirms the affected component is the npm package.

RemediationAI

Vendor-released patch: 0.14.0 - upgrade @nevware21/ts-utils to >= 0.14.0 via npm/yarn/pnpm and rebuild any applications or transitive dependents that bundle it, per the advisory at https://github.com/nevware21/ts-utils/security/advisories/GHSA-x7j8-49r8-mr43. If immediate upgrade is not possible, avoid passing untrusted JSON or any object derived from external input directly to objDeepCopy or objCopyProps, and sanitize incoming payloads by stripping __proto__, constructor, and prototype keys before deserialization or before invoking these helpers (trade-off: requires audit of every call site and may miss indirect callers in transitive dependencies). As a runtime defense, applications can freeze Object.prototype with Object.freeze(Object.prototype) at startup, though this can break libraries that legitimately extend prototypes and is not a substitute for patching.