Description
The utilities function in all versions <= 0.5.0 of the deep-extend node module can be tricked into modifying the prototype of Object when the attacker can control part of the structure passed to this function. This can let an attacker add or modify existing properties that will exist on all objects.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | node-deep-extend | 0.4.1-2 | — |
| Debian 13 | node-deep-extend | 0.4.1-2 | — |
| Debian 12 | node-deep-extend | 0.4.1-2 | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 18.04 LTS | node-deep-extend | No fix yet | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 8 | nodejs +3 | 1:12.20.1-1.module+el8.3.0+9503+19cb079c | RHSA-2021:0549 |
| RHEL 8 | nodejs-nodemon | 2.0.3-1.module+el8.3.0+9715+1718613f | RHSA-2021:0549 |
| RHEL 8 | nodejs-packaging | 17-3.module+el8.1.0+3369+37ae6a45 | RHSA-2021:0549 |
| RHEL 8 | npm | 1:6.14.10-1.12.20.1.1.module+el8.3.0+9503+19cb079c | RHSA-2021:0549 |
| RHEL 3 | rh-nodejs12-nodejs +2 | 12.20.1-1.el7 | RHSA-2021:0485 |
| RHEL 3 | rh-nodejs12-nodejs-nodemon | 2.0.3-1.el7 | RHSA-2021:0485 |
| RHEL 3 | rh-nodejs12-npm | 6.14.10-12.20.1.1.el7 | RHSA-2021:0485 |
| RHEL 3 | rh-nodejs8-nodejs +2 | 8.17.0-2.el7 | RHSA-2020:2625 |
| RHEL 3 | rh-nodejs8-npm | 6.13.4-8.17.0.2.el7 | RHSA-2020:2625 |
AlmaLinux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux 8 | nodejs-nodemon | 2.0.3-1.module_el8.4.0+2521+c668cc9f | ALSA-2021:0549 |
| AlmaLinux 8 | nodejs-packaging | 17-3.module_el8.3.0+2023+d2377ea3 | ALSA-2021:0549 |
Rocky Linux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Rocky Linux 8 | nodejs-nodemon | 2.0.3-1.module+el8.3.0+100+234774f7 | RLSA-2021:0549 |
| Rocky Linux 8 | nodejs-packaging | 17-3.module+el8.3.0+101+f84c7154 | RLSA-2021:0549 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| npm | deep-extend | < 0.5.1 | 0.5.1 | GHSA-hr2v-3952-633q |
Advisories 6
- ALSA-2021:0549 Moderate: nodejs:12 security update AlmaLinux Security Advisories · Oct 29, 2026
- WID-SEC-2026-2183 Red Hat Software Collections: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jul 2, 2026
- RHSA-2021:0549 Red Hat Security Advisory: nodejs:12 security update Red Hat Security Advisories (RHSA) · Jun 28, 2026
- RHSA-2021:0485 Red Hat Security Advisory: rh-nodejs12-nodejs security update Red Hat Security Advisories (RHSA) · Jun 28, 2026
- RHSA-2020:2625 Red Hat Security Advisory: rh-nodejs8-nodejs security update Red Hat Security Advisories (RHSA) · Jun 28, 2026
- RLSA-2021:0549 Moderate: nodejs:12 security update Rocky Linux Security Advisories · Feb 5, 2026