The utilities function in all versions <= 0.5.0 of the deep-extend node module can be tricked into modifying the prototype of Object when the attacker can control part of the structure passed to this function. This can let an attacker add or modify existing properties that will exist on all objects.

Affected: npm: deep-extend

Versions of `deep-extend` before 0.5.1 are vulnerable to prototype pollution.

## Recommendation

Update to version 0.5.1 or later.

nodejs-brace-expansion: Regular expression denial of service nodejs-chownr: TOCTOU vulnerability in `chownr` function in chownr.js nodejs-sshpk: ReDoS when parsing crafted invalid public keys in lib/formats/ssh.js nodejs-deep-extend: Prototype pollution can allow attackers to modify object properties npm: Symlink reference outside of node_modules folder through the bin field upon installation npm: Arbitrary file write via constructed entry in the package.json bin field npm: Global node_modules Binary Overwrite

nodejs-deep-extend: Prototype pollution can allow attackers to modify object properties nodejs-mixin-deep: prototype pollution in function mixin-deep nodejs-set-value: prototype pollution in function set-value nodejs-npm-user-validate: improper input validation when validating user emails leads to ReDoS nodejs-ini: Prototype pollution via malicious INI file nodejs: use-after-free in the TLS implementation nodejs: HTTP request smuggling via two copies of a header field in an http request

Affected: Ubuntu:18.04:LTS: node-deep-extend

The utilities function in all versions <= 0.5.0 of the deep-extend node module can be tricked into modifying the prototype of Object when the attacker can control part of the structure passed to this function. This can let an attacker add or modify existing properties that will exist on all objects.

Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Red Hat Software Collections ausnutzen, um die Vertraulichkeit, Verfügbarkeit und die Integrität der Anwendungen zu gefährden.