Prototype Pollution in lodash.defaultsdeep
Summary
GHSA-h5mp-5q4p-ggf5: Prototype Pollution in lodash.defaultsdeep. Affects lodash.defaultsdeep versions < 4.6.1. Fixed in 4.6.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
lodash.defaultsdeep is an npm package that provides a function for merging objects deeply. It is commonly used in JavaScript applications to merge default configuration objects with user-defined options. The package allows developers to merge objects recursively, ensuring that nested properties are combined correctly. However, versions of lodash.defaultsdeep prior to 4.6.1 are vulnerable to prototype pollution.
Vulnerability Detail
Prototype pollution is a vulnerability that occurs when an application allows user-controlled input to modify the prototype of an object. In the case of lodash.defaultsdeep, the function mergeWith can be exploited by a malicious user to modify the prototype of the Object constructor. By passing {constructor: {prototype: {...}}} as an argument, the attacker can add or modify properties that will exist on all objects. This can lead to unexpected behavior and potential security issues.
How To Fix
Latest published version: 4.6.1 as of 23 Oct 2026
npm install lodash.defaultsdeep@4.6.1The newest release already contains this fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to update to the fixed version of the package to mitigate the risk of prototype pollution.
Conclusion
Prototype pollution in lodash.defaultsdeep can be a serious security vulnerability that allows an attacker to modify the prototype of the Object constructor. To mitigate this risk, it is crucial to update the package to version 4.6.1 or later. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for lodash.defaultsdeep →
FAQ
Prototype pollution is a vulnerability that occurs when an application allows user-controlled input to modify the prototype of an object. This can lead to unexpected behavior and potential security issues.
lodash.defaultsdeep provides a function called mergeWith that allows developers to merge objects deeply. It ensures that nested properties are combined correctly.
The impact of this vulnerability depends on how the affected package is used in an application. If the package is used to merge user-defined options with default configuration objects, an attacker could modify the prototype of the Object constructor and introduce unexpected behavior or security issues.
Yes, updating lodash.defaultsdeep to version 4.6.1 or later fixes the prototype pollution issue. It is recommended to update the package to mitigate the risk.
There are no known workarounds for this vulnerability. Updating to the fixed version of the package is the recommended solution.
References
Related vulnerabilities
Recent vulnerabilities recorded for lodash.defaultsdeep.
