critical9.8
CVE-2018-16486
Prototype Pollution in defaults-deep
Impact
All versions of `defaults-deep` are vulnerable to prototype pollution. Provided certain input `defaults-deep` can add or modify properties of the `Object` prototype. These properties will be present on all objects. ## Recommendation As no patch is currently available for this vulnerability it is our recommendation to select another module that can provide this functionality.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| npm | defaults-deep | <= 0.2.4 | none recorded |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Defaults-Deep Project | Defaults-Deep | through 0.2.4 |