CVE-2018-16486: Defaults-Deep Project Defaults-Deep

Critical severity, CVSS 9.8. EPSS: 1.5% chance of exploitation in the next 30 days.

A prototype pollution vulnerability was found in defaults-deep <=0.2.4 that would allow a malicious user to inject properties onto Object.prototype.

Affected products

• Defaults-Deep Project Defaults-Deep: up to and including 0.2.4

Published 2019-02-01. Last modified 2026-06-17.