Which versions of Prototype Pollution are affected by CVE-2026-6621?

The extend-deep npm package (versions up to 0.1.6) contains a prototype pollution vulnerability that allows unauthenticated remote attackers to manipulate application objects and potentially…

Is there a public PoC exploit available for CVE-2026-6621?

Yes, a public proof-of-concept exploit is available for CVE-2026-6621. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate CVE-2026-6621?

Within 24 hours: Inventory all applications and dependencies using extend-deep via npm audit and SBOM review; audit code for direct or transitive usage in request/response handling. Within 7 days: Migrate to actively maintained alternatives (such as lodash.merge or native Object.assign patterns) and update all affected applications; verify prototype pollution mitigations are in place (input validation, Object.freeze on critical prototypes, or sandboxing). Within 30 days: Complete migration across all development, staging, and production environments; validate with security testing and update dependency manifests to exclude extend-deep entirely.

Prototype Pollution CVE-2026-6621

Q: What is the CVSS score of CVE-2026-6621?

CVE-2026-6621 has a CVSS 4.0 base score of 5.5 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-23812 MEDIUM

Improperly Controlled Modification of Object Prototype Attributes (Prototype Pollution) (CWE-1321)

2026-04-20 VulDB

GHSA-vr46-pfqh-wpf8

Information Disclosure Prototype Pollution

5.5

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

5.5 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

CVSS changed

Apr 29, 2026 - 01:12 NVD

6.9 (MEDIUM) 5.5 (MEDIUM)

PoC Detected

Apr 29, 2026 - 01:00 vuln.today

Public exploit code

Severity Changed

Apr 20, 2026 - 09:37 NVD

HIGH MEDIUM

CVSS changed

Apr 20, 2026 - 09:37 NVD

7.3 (HIGH) 6.9 (MEDIUM)

Analysis Generated

Apr 20, 2026 - 08:58 vuln.today

EUVD ID Assigned

Apr 20, 2026 - 08:45 euvd

EUVD-2026-23812

Analysis Generated

Apr 20, 2026 - 08:45 vuln.today

CVE Published

Apr 20, 2026 - 08:30 nvd

MEDIUM 5.5

DescriptionCVE.org

A vulnerability was determined in 1024bit extend-deep up to 0.1.6. The impacted element is an unknown function of the file index.js. This manipulation of the argument __proto__ causes improperly controlled modification of object prototype attributes. Remote exploitation of the attack is possible. The exploit has been publicly disclosed and may be utilized. The code repository of the project has not been active for many years.

AnalysisAI

Prototype pollution in extend-deep npm package (up to 0.1.6) enables remote attackers to manipulate JavaScript object prototypes via crafted __proto__ payloads, achieving low-severity confidentiality, integrity, and availability impacts. Public exploit code exists on GitHub. CVSS 7.3 with network attack vector and no authentication required. Project repository inactive for years, making official patch unlikely. EPSS data unavailable, but prototype pollution attacks are well-understood and automatable. Not listed in CISA KEV, suggesting limited widespread exploitation despite public POC.

Technical ContextAI

The extend-deep library (cpe:2.3:a:1024bit:extend-deep) is a JavaScript utility for deep object merging, commonly used in Node.js applications. This vulnerability stems from CWE-1321 (Improperly Controlled Modification of Object Prototype Attributes), the classic prototype pollution class. When extend-deep processes untrusted input containing __proto__ keys in index.js, it fails to sanitize property names during recursive object extension. Attackers can inject properties into Object.prototype, affecting all JavaScript objects in the application's runtime. This is a widespread vulnerability pattern in legacy JavaScript merge utilities predating modern secure-by-default alternatives. The affected package exists in the npm ecosystem and may be deeply embedded in dependency trees despite project abandonment.

RemediationAI

No vendor-released patch exists or will be released given the project's multi-year abandonment (RL:X). Primary remediation is dependency replacement: migrate to actively maintained alternatives such as lodash.merge (with prototype pollution protections enabled), deepmerge (version 4.3.0+), or native Object.assign/spread operators for shallow merging. Use npm audit or yarn audit to identify direct and transitive dependencies on extend-deep, then update parent packages that pull it in or fork/patch the dependency chain. Immediate compensating controls: implement input validation to reject or strip __proto__, constructor, and prototype keys before passing objects to extend-deep; deploy Object.freeze(Object.prototype) at application startup to prevent prototype modifications (may break legitimate code); run applications with --frozen-intrinsics flag in Node.js 18+ to lock built-in prototypes. Note that freezing prototypes can cause compatibility issues with legacy libraries expecting mutable prototypes. Runtime application self-protection (RASP) solutions can detect prototype pollution attempts. For containerized deployments, use minimal base images and dependency pinning to prevent introducing the package in new builds. Long-term: establish dependency lifecycle management to sunset unmaintained packages before vulnerabilities emerge.