CVE-2026-46509: Prototype Pollution in deepobj JavaScript Library

Technical summary

CVE-2026-46509 is a prototype pollution vulnerability in deepobj prior to 1.0.3, classified as CWE-1321 (Improperly Controlled Modification of Object Prototype Attributes). The attack exploits insufficient input validation on property paths passed to the library's get, set, and delete functions. By including __proto__, constructor, or prototype in the path string, an attacker can reach and modify the shared prototype object. This affects the entire application context, as modifications to Object.prototype or function constructors persist across all subsequently created objects. The CVSS v3.1 score of 8.2 (HIGH) reflects high integrity impact and some availability risk, with network accessibility and no privilege requirements.

Business impact

Applications relying on deepobj to handle user-controlled property paths face integrity and availability risks. A successful exploit can corrupt application state, trigger unexpected logic flows, or cause denial of service. In multi-tenant or shared environments, prototype pollution can leak or modify data belonging to other users or components. The risk is highest in web applications, APIs, and microservices that accept user input and process nested objects without sanitization, such as configuration engines, object mappers, or REST API backends that deserialize JSON with dynamic key access.

Affected systems

Any Node.js or JavaScript application using deepobj versions prior to 1.0.3 is vulnerable, provided the application exposes property paths to user input. This includes web applications, API servers, CLI tools, and backend services that rely on the library for object manipulation. The vulnerability does not affect deepobj 1.0.3 and later. Applications in air-gapped or offline environments with no user input to property paths carry reduced risk.

Exploitability

Exploitability is high if property paths are derived from untrusted sources. The attack requires no authentication, no user interaction, and is achievable over the network. A proof-of-concept is straightforward: an attacker simply passes a path like 'constructor.prototype.isAdmin' or '__proto__.admin' to a deepobj function. Detection by automatic scanning is feasible because the attack signature (keywords in property paths) is consistent. However, if property paths are hardcoded and never user-controlled, the risk is negated. The attack does not require special environment conditions or JavaScript engine bugs.

Remediation

Immediate remediation is to upgrade deepobj to version 1.0.3 or later. This version implements safeguards against pollution via reserved keywords. Short-term mitigations while patching is planned include: (1) sanitizing or validating property paths before passing them to deepobj, explicitly rejecting paths containing __proto__, constructor, or prototype; (2) running the application with frozen Object.prototype using Object.freeze(Object.prototype) to limit pollution impact; (3) restricting untrusted input to non-object-related operations or using allowlists of known-safe property names. Do not rely on sandboxing alone, as prototype pollution is not prevented by most sandbox mechanisms.

Patch guidance

Update deepobj to version 1.0.3 or later in your package.json or lock files. Run `npm update deepobj` or equivalent for your package manager, then test the update in a staging environment before production rollout. Verify that the patched version is actually deployed by checking `npm list deepobj` in the target environment or examining dependency lock files. No breaking changes are documented in 1.0.3, so upgrades should be non-disruptive. If you maintain a private fork or custom build, apply the same mitigation logic: reject or escape __proto__, constructor, and prototype keywords in property paths.

Detection guidance

Monitor for suspicious property path patterns in logs and traffic. Look for: (1) HTTP requests or API payloads containing __proto__, constructor, or prototype in JSON keys or query parameters passed to object manipulation endpoints; (2) Unexpected modifications to Object.prototype or global function constructors (use static analysis or runtime monitoring tools); (3) Unusual error messages or type errors that suggest object corruption; (4) Spike in 500 errors or assertion failures if the application uses prototype-based validation. In code review, search for calls to deepobj functions (e.g., deepobj.get, deepobj.set, deepobj.delete) preceded by user input or external data that isn't validated. Static analysis tools that detect unsafe prototype manipulation patterns can flag vulnerable code automatically.

Why prioritize this

This vulnerability merits prompt attention due to its HIGH severity, network accessibility, and ease of exploitation if property paths are user-controlled. Unlike many object manipulation bugs, prototype pollution is not environment-specific and can be triggered in production with a single malicious request. Organizations running Node.js backends, APIs, or services that deserialize and process user-supplied objects should treat this as a priority fix. The 1.0.3 patch is readily available and low-risk to deploy, making remediation friction minimal.

Risk score, explained

The CVSS v3.1 score of 8.2 reflects: (1) Attack Vector Network (AV:N)—exploitation is remote over the network; (2) Attack Complexity Low (AC:L)—no special conditions or brute-force required; (3) Privileges Required None (PR:N)—attacker needs no prior access; (4) User Interaction None (UI:N)—automatic exploitation is feasible; (5) Scope Unchanged (S:U)—impact is confined to the vulnerable application; (6) Confidentiality None (C:N)—no direct information disclosure; (7) Integrity High (I:H)—object state and logic can be corrupted; (8) Availability Low (A:L)—denial of service is possible but not primary. The score is HIGH, not CRITICAL, because confidentiality is not impacted and the attack assumes user-controlled input paths, which may not be universal across all deepobj deployments.

Frequently asked questions