defaults-deep CVE-2026-54737

Exploitation requires that the consuming application passes untrusted, user-controlled input to the defaultsDeep() function without prior key sanitization. If the application accepts structured input (e.g., JSON API bodies, query parameters parsed as objects) and feeds it to defaultsDeep() - a common pattern for configuration merging or default-value injection - then remote unauthenticated exploitation is possible (per CVSS PR:N). Exploitation is limited to Node.js applications that (1) import @phun-ky/defaults-deep versions below 2.0.5 and (2) expose an integration path between external input and the defaultsDeep() call. Applications that only pass internal, developer-controlled objects to defaultsDeep() are not exploitable. The vulnerability does not affect browser environments in isolation - it targets server-side Node.js process memory.

The CVSS 3.1 score of 7.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L) reflects worst-case conditions: a public-facing endpoint that passes raw user input to defaultsDeep() with no prior sanitization, requiring zero authentication or interaction. In practice, real-world risk is substantially conditional - exploitation requires an application integration path where untrusted data reaches the function, which is a non-trivial deployment assumption for a utility library. No EPSS score was provided in the input data, limiting probabilistic exploitation assessment. No CISA KEV listing and no confirmed public POC exist, meaning this is currently theoretical-to-low real-world risk for most deployments. The impact triad (C:L/I:L/A:L) reflects that prototype pollution is rarely a direct RCE primitive but can enable logic bypasses, property injection into framework internals, or denial of service depending on downstream code patterns. For applications that directly proxy API request bodies into defaultsDeep(), the risk elevation is real and immediate.

An attacker sends a POST request to an application endpoint that accepts JSON, embedding a payload such as {"__proto__": {"isAdmin": true}} or {"constructor": {"prototype": {"polluted": "yes"}}}. If the application passes this body directly to defaultsDeep(), Object.prototype is modified in the running Node.js process, causing every subsequent object property lookup for isAdmin or polluted to return the attacker-injected value, potentially bypassing authorization checks or triggering unexpected application behavior.