critical
CVE-2018-3750
nodejs-deep-extend: Prototype pollution can allow attackers to modify object properties
In the Trivy database since at least 24 Oct 2026, 07:11 UTCWhen it arrived before that build is not recorded.
Severity by source
NVD9.8CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
GHSA9.8CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Red Hat4.2CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:L
Trivy's own label is CRITICAL. Rated critical by NVD, GHSA. Rated lower by AlmaLinux (medium), Rocky Linux (medium), Ubuntu (medium), Red Hat (low).
Description
The utilities function in all versions <= 0.5.0 of the deep-extend node module can be tricked into modifying the prototype of Object when the attacker can control part of the structure passed to this function. This can let an attacker add or modify existing properties that will exist on all objects.
Affected packages and fixed versions
| Source | Package | Fixed in |
|---|---|---|
| npm::GitHub Security Advisory npm | deep-extend | 0.5.1 |
| alma 8 | nodejs:10::nodejs-nodemon, nodejs:10::nodejs-packaging | 2.0.3-1.module_el8.4.0+2521+c668cc9f and 1 more |
| debian 11 | node-deep-extend | 0.4.1-2 |
| debian 12 | node-deep-extend | 0.4.1-2 |
| debian 13 | node-deep-extend | 0.4.1-2 |
| debian 14 | node-deep-extend | 0.4.1-2 |
| echo | node-deep-extend | 0.4.1-2 |
| Red Hat | nodejs:10::nodejs-nodemon | no fix listed |
| rocky 8 | nodejs:12::nodejs-nodemon, nodejs:12::nodejs-packaging | 2.0.3-1.module+el8.6.0+982+9fdca2d4 and 1 more |
| ubuntu 18.04-ESM | node-deep-extend | no fix listed |
Show all 12 entries from 10 sources
| Source | Package | Fixed in |
|---|---|---|
| npm::GitHub Security Advisory npm | deep-extend | 0.5.1 |
| alma 8 | nodejs:10::nodejs-nodemon | 2.0.3-1.module_el8.4.0+2521+c668cc9f |
| alma 8 | nodejs:10::nodejs-packaging | 17-3.module_el8.3.0+2023+d2377ea3 |
| debian 11 | node-deep-extend | 0.4.1-2 |
| debian 12 | node-deep-extend | 0.4.1-2 |
| debian 13 | node-deep-extend | 0.4.1-2 |
| debian 14 | node-deep-extend | 0.4.1-2 |
| echo | node-deep-extend | 0.4.1-2 |
| Red Hat | nodejs:10::nodejs-nodemon | no fix listed |
| rocky 8 | nodejs:12::nodejs-nodemon | 2.0.3-1.module+el8.6.0+982+9fdca2d4 |
| rocky 8 | nodejs:12::nodejs-packaging | 17-3.module+el8.3.0+101+f84c7154 |
| ubuntu 18.04-ESM | node-deep-extend | no fix listed |
References
- https://access.redhat.com/security/cve/CVE-2018-3750
- https://bugzilla.redhat.com/show_bug.cgi?id=1795475
- https://bugzilla.redhat.com/show_bug.cgi?id=1795479
- https://bugzilla.redhat.com/show_bug.cgi?id=1892430
- https://bugzilla.redhat.com/show_bug.cgi?id=1907444
- https://bugzilla.redhat.com/show_bug.cgi?id=1912854
- https://bugzilla.redhat.com/show_bug.cgi?id=1912863
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-3750
All 25 references
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-10746
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-10747
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-7754
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-7788
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-8265
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-8287
- https://errata.almalinux.org/8/ALSA-2021-0549.html
- https://errata.rockylinux.org/RLSA-2021:0549
- https://github.com/advisories/GHSA-hr2v-3952-633q
- https://github.com/unclechu/node-deep-extend/commit/9423fae877e2ab6b4aecc4db79a0ed63039d4703
- https://github.com/unclechu/node-deep-extend/issues/39
- https://github.com/unclechu/node-deep-extend/pull/40
- https://hackerone.com/reports/311333
- https://nodesecurity.io/advisories/612
- https://nvd.nist.gov/vuln/detail/CVE-2018-3750
- https://www.cve.org/CVERecord?id=CVE-2018-3750
- https://www.npmjs.com/advisories/612