CVE-2019-10750: Prototype Pollution in deeply
Summary
CVE-2019-10750: Prototype Pollution in deeply. Affects deeply versions < 3.1.0. Fixed in 3.1.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The 'deeply' package is an npm package that provides functionality for deep cloning and merging JavaScript objects. It is widely used in various applications and libraries. However, versions prior to 1.0.1 are vulnerable to a Prototype Pollution attack. This vulnerability occurs due to the package's failure to properly validate the properties it updates on objects. As a result, an attacker can modify the prototype of the Object, leading to the addition or modification of existing properties on all objects.
Vulnerability Detail
The Prototype Pollution vulnerability in 'deeply' allows an attacker to manipulate the prototype of the Object, enabling them to modify or add properties to all objects in the application. This can lead to various security issues, including remote code execution, information disclosure, and privilege escalation. The vulnerability has a CVSS score of 9.8, indicating its critical severity.
How To Fix
Latest published version: 3.1.0 as of 23 Oct 2026
npm install deeply@3.1.0The newest release already contains this fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
The 'deeply' package prior to version 1.0.1 is vulnerable to Prototype Pollution, which can have severe security implications. It is crucial to upgrade to version 3.1.0 or later to mitigate the risk. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for deeply →
FAQ
Prototype Pollution is a vulnerability that occurs when a JavaScript application allows the modification of Object prototypes. This can lead to unintended changes in the behavior of the application and potential security risks.
The Prototype Pollution vulnerability in 'deeply' can have severe consequences, including remote code execution, information disclosure, and privilege escalation. Attackers can manipulate the prototype of the Object, enabling them to modify or add properties to all objects in the application.
You can use the Vulert Playground at Vulert Scanner to check if your application is affected by this vulnerability. The playground analyzes your package-lock.json file and alerts you in real-time for any open-source vulnerabilities, including Prototype Pollution in 'deeply'.
At the moment, there are no known workarounds for this vulnerability. It is strongly recommended to upgrade to the fixed version of the 'deeply' package (3.1.0 or later) to mitigate the risk.
You can find more information about this vulnerability in the GitHub Security Advisory database at https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2019/08/GHSA-8j4w-5fw4-rm27/GHSA-8j4w-5fw4-rm27.json
