CVE-2021-23442: Prototype Pollution in @cookiex/deep
Summary
CVE-2021-23442: Prototype Pollution in cookiex/deep. Affects @cookiex/deep versions < 0.0.7. Fixed in 0.0.7. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The @cookiex/deep package is an npm package that provides functionality for deep object manipulation. It allows users to perform operations such as deep merging, deep cloning, and deep comparison of JavaScript objects. However, versions prior to 0.0.7 are vulnerable to prototype pollution.
Vulnerability Detail
Prototype pollution is a vulnerability that occurs when an attacker can inject properties into existing JavaScript objects. In the case of @cookiex/deep, the global proto object can be polluted using the proto object. This can lead to various security issues, including remote code execution, denial of service, and data integrity violations.
How To Fix
Latest published version: 0.0.7 as of 23 Oct 2026
npm install @cookiex/deep@0.0.7The newest release already contains this fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is recommended to upgrade to the fixed version of the package as soon as possible.
Conclusion
The @cookiex/deep package prior to version 0.0.7 is vulnerable to prototype pollution. This can lead to serious security issues, including remote code execution and data integrity violations. Users should upgrade to version 0.0.7 or later to fix this vulnerability. For further support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for @cookiex/deep →
FAQ
Prototype pollution is a vulnerability that allows an attacker to modify the prototype of an object, leading to unexpected behavior and potential security issues.
The prototype pollution vulnerability in @cookiex/deep can lead to remote code execution, denial of service, and data integrity violations.
You can use the Vulert Playground at Vulert Scanner to check if your application is affected by this vulnerability. Simply provide your package-lock.json file and the playground will alert you if the vulnerability is present.
Yes, upgrading to version 0.0.7 or later of the @cookiex/deep package will fix the prototype pollution vulnerability.
There are no known workarounds for this vulnerability. It is recommended to upgrade to the fixed version of the package.
