Critical, CVSS 9.4npmAmendedPublished
deepHas vulnerable to Prototype Pollution via constructor.prototype
CVE-2026-25047 · GHSA-2733-6c58-pf27
- Affected
- npm deephas < 1.0.8
- Fixed in
- 1.0.8· Vendor fix available
- Issue
- A prototype pollution vulnerability exists in version 1.0.7 of the deephas npm package that allows an attacker to modify global object behavior. This issue was fixed in version 1.0.8. Details The vulnerability resides in the add() function and indexer() function implemented within deepHas.js. Although version 1.0.7 attempts to prevent prototype pollution by checking property ownership (e.g., using Object.hasOwnProperty) and by checking against forbidden string usage (using String.prototype.indexOf), this check can be bypassed as shown in the PoC By doing so, an attacker can inject properties into Object.prototype through a payload such as constructor.prototype.polluted or proto.polluted resulting in prototype pollution. This issue affects all JavaScript runtimes that rely on npm packages (including Node.js, Deno, and Bun) and is independent of the operating system. PoC Steps to reproduce 1. Install version 1.0.7 of deephas using npm install 2. Run one of the following code…
Recommended action: Upgrade to 1.0.8 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.