CVE-2020-28442: Js-Data

Critical severity, CVSS 9.8. EPSS: 2% chance of exploitation in the next 30 days.

All versions of package js-data are vulnerable to Prototype Pollution via the deepFillIn function.

Affected products

• Js-Data Js-Data: any version

Published 2020-12-15. Last modified 2026-06-17.