CVE-2018-16492: Prototype Pollution in extend
Summary
CVE-2018-16492: Prototype Pollution in extend. Affects extend across 2 version ranges.
< 2.0.2
>= 3.0.0, < 3.0.2
Fixed in 2.0.2 or 3.0.2, depending on the release line you run. How to fix ↓
Also tracked for
- node-extend · Debian:11
The same CVE-2018-16492 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The extend package is an npm package that provides a utility function called extend() for extending objects in JavaScript. It allows developers to merge multiple objects into a single object, combining their properties. However, versions of extend prior to 3.0.2 (for 3.x) and 2.0.2 (for 2.x) are vulnerable to Prototype Pollution.
Vulnerability Detail
Prototype Pollution is a vulnerability that occurs when an attacker can modify the prototype of an object, leading to the addition or modification of properties that will exist on all objects. In the case of extend, the extend() function can be exploited by attackers to pollute the prototype of the Object constructor, allowing them to modify or add properties that will affect all objects in the application. This can lead to unexpected behavior, data tampering, or even remote code execution.
How To Fix
Latest published version: 3.0.2 as of 23 Oct 2026
npm install extend@3.0.2The newest release already contains this fix.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 2.0.22.0.2npm install extend@2.0.2
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no known workaround for this vulnerability. It is recommended to upgrade to the fixed versions of extend as mentioned above.
Conclusion
In conclusion, the extend package prior to versions 3.0.2 (for 3.x) and 2.0.2 (for 2.x) is vulnerable to Prototype Pollution. It is crucial to upgrade to the fixed versions to mitigate the risk of unexpected behavior, data tampering, or remote code execution. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for extend →
FAQ
Prototype Pollution is a vulnerability that allows attackers to modify the prototype of an object, leading to the addition or modification of properties that will exist on all objects.
The impact of this vulnerability can vary depending on how the affected package is used. It can lead to unexpected behavior, data tampering, or even remote code execution.
You can use the Vulert Playground at Vulert Scanner to check if your application is affected by this vulnerability. Simply upload your package-lock.json file and it will alert you if the vulnerability is present.
There are no known workarounds for this vulnerability. It is recommended to upgrade to the fixed versions of extend.
You can find more information about this vulnerability in the GitHub Advisory Database at the following link: https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2019/02/GHSA-qrmc-fj45-qfc2/GHSA-qrmc-fj45-qfc2.json
