The @phun-ky/defaults-deep library prior to version 2.0.5 is vulnerable to prototype pollution, which can lead to application-wide logic bypasses or crashes.

This library is susceptible to prototype pollution (CWE-1321), where an attacker can improperly modify object prototype attributes. The vulnerability is network-exploitable by an unauthenticated attacker.

Prototype pollution can be used to alter the behavior of an application in unexpected ways, potentially leading to privilege escalation, data manipulation, or denial of service. With a CVSS score of 7.3, this flaw represents a significant risk to the integrity and availability of Node.js applications that utilize this package.

Immediate Action: Update the @phun-ky/defaults-deep dependency to version 2.0.5 or later in all project package manifests.

Proactive Monitoring: Monitor applications for unusual error patterns or unexpected property changes in objects that may indicate attempts to pollute the prototype chain.

Compensating Controls: Utilize security linting tools or runtime protections that detect and block attempts to modify the Object.prototype.

Public Exploit Available: Unknown.

Prototype pollution vulnerabilities can be difficult to detect once they have been triggered, making proactive patching essential. Development teams should immediately update to version 2.0.5 to protect their applications from potential logic manipulation and integrity compromise.