9.4

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-25047

CVE-2026-25047: deepHas vulnerable to Prototype Pollution via constructor.prototype

Summary

A prototype pollution vulnerability exists in version 1.0.7 of the deephas npm package that allows an attacker to modify global object behavior. This issue was fixed in version 1.0.8.

Details

The vulnerability resides in the add() function and indexer() function implemented within deepHas.js. Although version 1.0.7 attempts to prevent prototype pollution by checking property ownership (e.g., using Object.hasOwnProperty) and by checking against forbidden string usage (using String.prototype.indexOf), this check can be bypassed as shown in the PoC

By doing so, an attacker can inject properties into Object.prototype through a payload such as constructor.prototype.polluted or proto.polluted resulting in prototype pollution.

This issue affects all JavaScript runtimes that rely on npm packages (including Node.js, Deno, and Bun) and is independent of the operating system.

PoC

Steps to reproduce

Install version 1.0.7 of deephas using npm install
Run one of the following code snippets:

//PoC 1
Object.prototype.hasOwnProperty = () => true;
console.log({}.polluted);
const dh = require('deephas');
let obj = {};
dh.set(obj, 'constructor.prototype.polluted', 'yes');
console.log('{ ' + obj.polluted + ', ' + 'yes' + ' }'); // prints yes => the patch is bypassed and prototype pollution occurred

//PoC 2
String.prototype.indexOf = () => -1;
console.log({}.polluted);
const dh = require('deephas');
let obj = {};
dh.set(obj, '__proto__.polluted', 'yes');
console.log('{ ' + obj.polluted + ', ' + 'yes' + ' }'); // prints yes => the patch is bypassed and prototype pollution occurred

Expected behavior

Prototype pollution should be prevented and {} should not gain new properties. This should be printed on the console:

undefined
undefined OR throw an Error

Actual behavior

Object.prototype is polluted and the property polluted becomes globally accessible. This is printed on the console:

Miggo Vulnerability Database

→

CVE-2026-25047

CVE-2026-25047:

9.4

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
deephas	npm	< 1.0.8	1.0.8

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The analysis of the patch for CVE-2026-25047 in the 'deephas' library reveals a prototype pollution vulnerability. The root cause lies within the add function in deepHas.js, which is responsible for setting nested properties on an object based on a string path.

The vulnerable version of the add function implemented an inadequate security check to prevent path segments like __proto__ from being used. This check, str.indexOf('__proto__'), could be easily bypassed if an attacker first overrides the String.prototype.indexOf method to always return -1. The PoC demonstrates this bypass, as well as another using constructor.prototype which was not checked at all.

Once the check in add is bypassed, the malicious path is passed to Array.prototype.reduce, which uses the indexTrue function (referred to as indexer in the advisory) to traverse the object. The indexTrue function then performs the unsafe property access (e.g., accessing obj['constructor']) which ultimately allows the attacker to pollute the Object.prototype.

The patch addresses the vulnerability at its source in the add function. It replaces the weak, bypassable check with a robust loop that iterates over each segment of the path, explicitly checking for __proto__, constructor, and prototype. This ensures that any malicious path is rejected before it can be used to traverse and modify the object, thus preventing the indexTrue function from being exploited.

Vulnerable functions

add

deepHas.js

The `add` function is the entry point for the vulnerability. It takes a user-controlled path string (`str`) to set a value in an object. The vulnerable version used a weak check (`str.indexOf('__proto__')`) to prevent prototype pollution. This check could be bypassed by overriding `String.prototype.indexOf`, allowing malicious paths like `constructor.prototype.polluted` to be processed, leading to prototype pollution. The patch replaces this weak check with a robust loop that inspects each segment of the path for forbidden keywords (`__proto__`, `constructor`, `prototype`).

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.

9.4

-

Basic Information

Basic Information

Concerned about an active attack path?

CVE-2026-25047: deepHas vulnerable to Prototype Pollution via constructor.prototype

Summary

Details

PoC

Steps to reproduce

Expected behavior

Actual behavior

CVE-2026-25047:

9.4

-

Basic Information

Basic Information

Is this CVE running in your environment?

Technical Details

Technical Details

Vulnerability IntelligenceMiggo AI

Root Cause Analysis

Vulnerable functions

Vulnerability IntelligenceMiggo AI

Unlock WAF rules for this CVE

WAF Protection Rules

WAF Rule

Reasoning

9.4

9.4

Basic Information

Basic Information

Technical Details

CVE-2026-25047: deepHas vulnerable to Prototype Pollution via constructor.prototype

Summary

Details

PoC

Steps to reproduce

Expected behavior

Actual behavior

Vulnerability IntelligenceMiggo AI

Root Cause Analysis

Vulnerable functions

Impact

Vulnerability Intelligence
Miggo AI

Vulnerability Intelligence
Miggo AI

Vulnerability Intelligence
Miggo AI