CVE-2018-16491: Dreamerslab Node.extend

Critical severity, CVSS 9.8. EPSS: 1.7% chance of exploitation in the next 30 days.

A prototype pollution vulnerability was found in node.extend <1.1.7, ~<2.0.1 that allows an attacker to inject arbitrary properties onto Object.prototype.

Affected products

• Dreamerslab Node.extend: before 1.1.7 (fixed in 1.1.7); from 2.0.0, before 2.0.1 (fixed in 2.0.1)

Published 2019-02-01. Last modified 2026-06-17.