CVE-2026-54737

@phun-ky/defaults-deep is a library like lodash defaultsDeep with array preservation and no lodash dependency. Prior to 2.0.5, defaultsDeep() recursively merges user-supplied objects without filtering proto, constructor, and prototype, allowing properties to be written to Object.prototype. This issue is fixed in version 2.0.5.

• CWE-1321

• https://github.com/phun-ky/defaults-deep/commit/807dba930f8718f9126cad59d949b8fd3539b059
• https://github.com/phun-ky/defaults-deep/pull/49
• https://github.com/phun-ky/defaults-deep/releases/tag/2.0.5
• https://github.com/phun-ky/defaults-deep/security/advisories/GHSA-mj3g-7xcc-x4vh

Published

Jul 31, 2026

Last Modified

Jul 31, 2026

Status

Received

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-54728bunkerweb is an Open-source and next-generation Web Applicat…6.1
• CVE-2026-54729DSSRF is a Node.js library that provides a wide range of uti…8.7
• CVE-2026-5473A vulnerability has been found in NASA cFS up to 7.0.0. The …7
• CVE-2026-54733The Microsoft 365 and Microsoft Entra ID Plugins for Moodle …9.3
• CVE-2026-54735Prebid Server is an open-source solution for running real-ti…10
• CVE-2026-54736Phalcon is a high-performance, full-stack PHP framework. Pri…8.2
• CVE-2026-5474A vulnerability was found in NASA cFS up to 7.0.0. This affe…8.8
• CVE-2026-5475A vulnerability was determined in NASA cFS up to 7.0.0. This…5.5
• CVE-2026-54753Nx is a monorepo solution for TypeScript and polyglot codeba…5.9
• CVE-2026-54756Jodit Editor is a WYSIWYG editor with written in pure TypeSc…6.3
• CVE-2026-54759SiYuan is an open-source personal knowledge management syste…8.7
• CVE-2026-5476A vulnerability was identified in NASA cFS up to 7.0.0 on 32…4.6