CVE-2018-3723: Prototype Pollution in defaults-deep
Summary
CVE-2018-3723: Prototype Pollution in defaults-deep. Affects defaults-deep versions < 0.2.4. Fixed in 0.2.4. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The defaults-deep package is an npm package that provides a function for merging default values deeply into an object. It is commonly used in JavaScript applications to set default values for configuration objects. The package allows developers to merge default values into an object, recursively merging nested objects as well. This vulnerability affects versions of defaults-deep prior to 0.2.4.
Vulnerability Detail
The vulnerability in defaults-deep is due to prototype pollution. Prototype pollution is a type of vulnerability that occurs when an attacker can inject properties into existing objects, including the prototype chain, leading to unexpected behavior in the application. In the case of defaults-deep, an attacker can manipulate the prototype of an object and inject malicious properties, potentially leading to code execution or privilege escalation.
How To Fix
Latest published version: 0.2.4 as of 22 Oct 2026
npm install defaults-deep@0.2.4The newest release already contains this fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
The defaults-deep package prior to version 0.2.4 is vulnerable to prototype pollution. To mitigate this vulnerability, it is recommended to update to version 0.2.4 or later. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for defaults-deep →
FAQ
Prototype pollution is a vulnerability that allows an attacker to inject properties into existing objects, including the prototype chain, leading to unexpected behavior in the application.
The impact of this vulnerability can vary depending on the specific application and how the defaults-deep package is used. In some cases, it could lead to code execution or privilege escalation.
You can use the Vulert Playground at Vulert Scanner to check if your application is affected by this vulnerability. Simply upload your package-lock.json file and the tool will analyze it for any known vulnerabilities.
No, the recommended fix for this vulnerability is to update to version 0.2.4 or later of the defaults-deep package.
You can find more information about this vulnerability in the GitHub Advisory Database at https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2018/07/GHSA-cqp5-m4pq-gfgp/GHSA-cqp5-m4pq-gfgp.json
Related vulnerabilities
Recent vulnerabilities recorded for defaults-deep.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
