CVE-2026-25047: deephas Package Prototype Pollution Vulnerability
Summary
CVE-2026-25047: deepHas vulnerable to Prototype Pollution via constructor.prototype. Affects deephas versions < 1.0.8. Fixed in 1.0.8. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The deephas package is a JavaScript utility designed for deep property access and manipulation within objects. It allows developers to easily set and retrieve nested properties in complex data structures. However, a critical vulnerability has been identified in version 1.0.7, which exposes applications to prototype pollution attacks, potentially compromising the integrity of the global object.
Vulnerability Detail
A prototype pollution vulnerability exists in version 1.0.7 of the deephas npm package. This vulnerability allows attackers to modify the behavior of the global object by injecting properties into Object.prototype. The issue arises from insufficient checks in the add() and indexer() functions within deepHas.js, which can be bypassed. By exploiting this vulnerability, an attacker can execute malicious payloads, leading to severe security implications such as authentication bypass, denial of service, or even remote code execution if polluted properties are used in unsafe contexts.
How To Fix
Latest published version: 1.0.8 as of 23 Oct 2026
npm install deephas@1.0.8The newest release already contains this fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, avoid using the deephas package until it has been updated. If you must use it, ensure that you sanitize and validate any input that could potentially be manipulated by an attacker. Additionally, you can override the prototype methods that are being exploited in the following way:
Object.prototype.hasOwnProperty = () => true;
String.prototype.indexOf = () => -1;
Conclusion
The deephas package has a critical prototype pollution vulnerability that can lead to severe security risks. It is essential to update to version 1.0.8 or later to mitigate these risks. Additionally, implementing input validation and using tools like Vulert can help maintain the security of your applications.
See every vulnerability recorded for deephas →
FAQ
Prototype pollution is a security vulnerability that allows an attacker to inject properties into the prototype of an object, potentially altering the behavior of all instances of that object.
If your application uses deephas to process user-controlled input, an attacker could exploit this vulnerability to manipulate the global object, leading to security breaches such as unauthorized access or code execution.
If you cannot update the deephas package right away, implement input validation and sanitation to mitigate the risk of exploitation. Additionally, consider using alternative libraries that do not have this vulnerability.
No, this vulnerability affects all JavaScript runtimes that rely on npm packages, including Node.js, Deno, and Bun, regardless of the operating system.
You can use tools like Vulert, which monitors and alerts for open-source vulnerabilities in your software by analyzing your package-lock.json file. You can also check your application against known vulnerabilities using the Vulert playground without any signup.
References
Related vulnerabilities
Recent vulnerabilities recorded for deephas.
