CVE-2026-25047: 
JavaScript vulnerability analysis and mitigation

CVE-2026-25047 is a prototype pollution vulnerability in the deephas npm package (version 1.0.7) that allows an attacker to modify global Object.prototype behavior, potentially leading to authentication bypass, denial of service, or remote code execution. The deephas package provides a utility for testing the existence of nested object keys. The vulnerability was published on January 29, 2026, and fixed in version 1.0.8. It carries a CVSS v3.1 score of 8.8 (High) and a CVSS v4.0 score of 9.4 (Critical) (Github Advisory, GitHub Security Advisory).

The vulnerability is classified as CWE-1321 (Improperly Controlled Modification of Object Prototype Attributes) and resides in the add() and indexer() functions within deepHas.js. Version 1.0.7 attempted to prevent prototype pollution by checking property ownership via Object.hasOwnProperty and blocking forbidden strings using String.prototype.indexOf, but both checks can be bypassed: an attacker can override Object.prototype.hasOwnProperty to always return true, or override String.prototype.indexOf to always return -1, neutralizing the guards. Once bypassed, a crafted key such as constructor.prototype.polluted or __proto__.polluted passed to deephas.set() injects arbitrary properties into Object.prototype, affecting all JavaScript objects in the runtime. The vulnerability affects all JavaScript runtimes using npm packages (Node.js, Deno, Bun) and is OS-independent (Github Advisory, GitHub Security Advisory).

Successful exploitation allows an attacker to inject arbitrary properties into Object.prototype, making those properties globally accessible across all JavaScript objects in the affected runtime. Depending on how the downstream application uses deephas, this can lead to authentication bypass (if security checks rely on prototype-inherited properties), denial of service, or remote code execution if polluted properties are passed to dangerous sinks such as eval or child_process. The impact scope is marked as CHANGED, meaning effects extend beyond the vulnerable component itself to all processes and data accessible through the modified global objects (Github Advisory, GitHub Security Advisory).

Public proof-of-concept (PoC) exploit code is available on GitHub, including a dedicated PoC repository (PoC Repository) and the official security advisory (GitHub Security Advisory). An additional exploit was published on Exploit-DB (EDB-52528). There is currently no evidence of in-the-wild exploitation, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.015–0.169%, indicating a low but non-negligible probability of exploitation in the near term (Github Advisory).

1. Identify target: Locate a Node.js (or Deno/Bun) application that uses deephas version 1.0.7 as a dependency and passes attacker-controlled input to deephas.set().
2. Bypass PoC 1 — Override hasOwnProperty: Before calling deephas.set(), override the prototype guard by executing Object.prototype.hasOwnProperty = () => true;. This causes the ownership check in add() to always pass.
3. Inject via constructor.prototype: Call dh.set(obj, 'constructor.prototype.polluted', 'yes'). Because the hasOwnProperty check is bypassed, the function traverses constructor.prototype and sets the polluted property on Object.prototype.
4. Bypass PoC 2 — Override String.prototype.indexOf: Alternatively, execute String.prototype.indexOf = () => -1; to neutralize the __proto__ string check, then call dh.set(obj, '__proto__.polluted', 'yes').
5. Confirm pollution: Verify that {}.polluted returns 'yes', confirming that Object.prototype has been modified globally.
6. Achieve objective: Leverage the polluted property to bypass authentication logic, cause denial of service, or pass the polluted value to a dangerous sink (e.g., eval, child_process.exec) for remote code execution, depending on the application's code paths (Github Advisory, GitHub Security Advisory).

• Logs: Unexpected errors or stack traces in Node.js application logs related to prototype property access or modification; unusual TypeError exceptions referencing Object.prototype or constructor.prototype.
• File System: Presence of deephas version 1.0.7 in node_modules/deephas/package.json ("version": "1.0.7") across deployed applications.
• Process Behavior: Unexpected child processes spawned by the Node.js runtime (e.g., sh, bash, cmd.exe) if prototype pollution reaches a child_process sink; application behavior changes such as authentication checks unexpectedly passing for unauthorized users.
• Network: Unusual outbound connections from the Node.js application process if a reverse shell payload is executed via a polluted eval or child_process sink.

The vulnerability is fixed in deephas version 1.0.8, which replaces the bypassable String.prototype.indexOf and Object.hasOwnProperty checks with a robust key-by-key validation that explicitly blocks __proto__, constructor, and prototype as path segments (GitHub Commit). Organizations should immediately upgrade the deephas npm package from version 1.0.7 to 1.0.8 or later using npm install deephas@latest. Conduct a dependency inventory to identify all applications using deephas 1.0.7, and implement dependency scanning (e.g., npm audit, Dependabot) and version pinning policies to prevent future exposure (Github Advisory).

The vulnerability was credited to three independent finders (kevgeoleo, vdata1, reallyTG), suggesting coordinated responsible disclosure. Red Hat tracked the issue under their CVE database, and INCIBE-CERT published an early warning alert. Community coverage appeared on security aggregators including VulnDB, CXSecurity, and Bluesky CVE feeds shortly after disclosure (Github Advisory).