Most recent entries from all

EUVD-2026-181182

fkie_cve-2018-3750

The utilities function in all versions <= 0.5.0 of the deep-extend node module can be tricked into modifying the prototype of Object when the attacker can control part of the structure passed to this function. This can let an attacker add or modify existing properties that will exist on all objects.

GHSA-hr2v-3952-633q — Prototype Pollution in deep-extend

Affected: npm: deep-extend

Versions of `deep-extend` before 0.5.1 are vulnerable to prototype pollution.

## Recommendation

Update to version 0.5.1 or later.

gsd-2018-3750

RHSA-2020:2625 — Red Hat Security Advisory: rh-nodejs8-nodejs security update

nodejs-brace-expansion: Regular expression denial of service nodejs-chownr: TOCTOU vulnerability in `chownr` function in chownr.js nodejs-sshpk: ReDoS when parsing crafted invalid public keys in lib/formats/ssh.js nodejs-deep-extend: Prototype pollution can allow attackers to modify object properties npm: Symlink reference outside of node_modules folder through the bin field upon installation npm: Arbitrary file write via constructed entry in the package.json bin field npm: Global node_modules Binary Overwrite

RHSA-2021:0549 — Red Hat Security Advisory: nodejs:12 security update

nodejs-deep-extend: Prototype pollution can allow attackers to modify object properties nodejs-mixin-deep: prototype pollution in function mixin-deep nodejs-set-value: prototype pollution in function set-value nodejs-npm-user-validate: improper input validation when validating user emails leads to ReDoS nodejs-ini: Prototype pollution via malicious INI file nodejs: use-after-free in the TLS implementation nodejs: HTTP request smuggling via two copies of a header field in an http request

UBUNTU-CVE-2018-3750

Affected: Ubuntu:18.04:LTS: node-deep-extend

WID-SEC-W-2026-2183 — Red Hat Software Collections: Mehrere Schwachstellen

Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Red Hat Software Collections ausnutzen, um die Vertraulichkeit, Verfügbarkeit und die Integrität der Anwendungen zu gefährden.