CVE-2019-10746: Prototype Pollution in mixin-deep
Summary
CVE-2019-10746: Prototype Pollution in mixin-deep. Affects mixin-deep across 2 version ranges.
< 1.3.2
>= 2.0.0, < 2.0.1
Fixed in 1.3.2 or 2.0.1, depending on the release line you run. How to fix ↓
Also tracked for
- node-mixin-deep · Debian:11
The same CVE-2019-10746 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
mixin-deep is an npm package that provides a function called mixinDeep, which is used to merge the properties of multiple objects into a single object. It is commonly used in JavaScript applications to simplify object manipulation and composition. However, versions of mixin-deep prior to 2.0.1 or 1.3.2 are vulnerable to Prototype Pollution. This vulnerability allows attackers to modify the prototype of Object, leading to the addition or modification of existing properties on all objects.
Vulnerability Detail
The mixinDeep function in mixin-deep fails to validate the properties it updates, allowing attackers to perform Prototype Pollution attacks. By manipulating the input objects, an attacker can modify the prototype of Object and introduce or modify properties that will affect all objects in the application. This can lead to various security issues, such as remote code execution, information disclosure, or denial of service.
How To Fix
Latest published version: 2.0.1 as of 23 Oct 2026
npm install mixin-deep@2.0.1The newest release already contains this fix.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 1.3.21.3.2npm install mixin-deep@1.3.2
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to upgrade to a secure version of mixin-deep to mitigate the risk of Prototype Pollution.
Conclusion
In conclusion, the mixin-deep package prior to version 2.0.1 or 1.3.2 is vulnerable to Prototype Pollution. This can lead to severe security issues in applications that use this package. It is highly recommended to upgrade to a secure version of mixin-deep to mitigate the risk of Prototype Pollution. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for mixin-deep →
FAQ
mixin-deep is an npm package that provides a function called mixinDeep, which is used to merge the properties of multiple objects into a single object.
Prototype Pollution is a vulnerability that occurs when an attacker can modify the prototype of an object, leading to the addition or modification of properties that affect all objects in the application.
The consequences of this vulnerability can vary depending on the specific application. However, possible outcomes include remote code execution, information disclosure, or denial of service.
To fix this vulnerability, you should upgrade to a non-vulnerable version of mixin-deep. If you are using version 2.x, upgrade to version 2.0.1 or later. If you are using version 1.x, upgrade to version 1.3.2 or later.
No, there is no known workaround for this vulnerability. It is crucial to upgrade to a secure version of mixin-deep.
References
Related vulnerabilities
Recent vulnerabilities recorded for mixin-deep.
