{"metadata": {"vulnerability": "CVE-2026-54737", "count": 12, "kinds": {"milestone": 4, "sighting": 1, "kev": 0, "other": 7}}, "data": [{"timestamp": "2026-06-15T23:07:33.233Z", "date_only": false, "value": "2026-06-15T23:07:33.233Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "CVE-2026-54737", "field": "cveMetadata.dateReserved"}, {"timestamp": "2026-07-31T17:48:42.670Z", "date_only": false, "value": "2026-07-31T17:48:42.670Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-54737", "field": "cveMetadata.datePublished"}, {"timestamp": "2026-07-31T17:48:42.670Z", "date_only": false, "value": "2026-07-31T17:48:42.670Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / GitHub_M", "record": "CVE-2026-54737", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2026-07-31T17:49:08Z", "date_only": false, "value": "2026-07-31T17:49:08Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-MJ3G-7XCC-X4VH", "record": "GHSA-MJ3G-7XCC-X4VH", "field": "published"}, {"timestamp": "2026-07-31T17:49:09Z", "date_only": false, "value": "2026-07-31T17:49:09Z", "kind": "other", "label": "Updated", "source": "github \u00b7 GHSA-MJ3G-7XCC-X4VH", "record": "GHSA-MJ3G-7XCC-X4VH", "field": "modified"}, {"timestamp": "2026-07-31T18:17:17.330Z", "date_only": false, "value": "2026-07-31T18:17:17.330", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-54737", "record": "FKIE_CVE-2026-54737", "field": "published"}, {"timestamp": "2026-07-31T18:32:14.083Z", "date_only": false, "value": "2026-07-31T18:32:14.083108Z", "kind": "sighting", "label": "Seen", "source": "https://gist.github.com/alon710/3afa9bbe175e1dfd1649cd2081ad6eb5", "record": "CVE-2026-54737", "field": "creation_timestamp", "uuid": "a64e1f62-1130-4412-a46c-1085be73fe60", "content": "# CVE-2026-54737: CVE-2026-54737: Prototype Pollution in @phun-ky/defaults-deep\n\n> **CVSS Score:** 7.3\n> **Published:** 2026-07-31\n> **Full Report:** https://cvereports.com/reports/CVE-2026-54737\n\n## Summary\nCVE-2026-54737 is a high-severity Prototype Pollution vulnerability in the @phun-ky/defaults-deep npm library prior to version 2.0.5. Due to unsafe recursive object merging, unauthenticated attackers can supply structured payloads that modify the properties of Object.prototype, compromising the runtime process state.\n\n## TL;DR\nA prototype pollution vulnerability in the recursive merging function of @phun-ky/defaults-deep versions prior to 2.0.5 allows remote attackers to execute arbitrary modification of Object.prototype attributes via crafted inputs.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-1321\n- **Attack Vector**: Network (AV:N)\n- **CVSS Score**: 7.3 (High)\n- **EPSS Status**: Not Registered\n- **Impact**: Prototype Pollution (Privilege Escalation, DoS, RCE)\n- **Exploit Status**: PoC Available\n- **KEV Status**: Not Listed\n\n## Affected Systems\n\n- Node.js runtime environments using @phun-ky/defaults-deep dependency\n- **@phun-ky/defaults-deep**: < 2.0.5 (Fixed in: `2.0.5`)\n\n## Mitigation\n\n- Upgrade @phun-ky/defaults-deep to version 2.0.5 or above\n- Implement structural deep-sanitization recursive functions on all input middleware\n- Enforce strict prototype freezing at the initialization stage of Node.js services\n\n**Remediation Steps:**\n1. Run npm install @phun-ky/defaults-deep@2.0.5 inside project workspaces\n2. Incorporate input validation schemas such as AJV or Joi to reject properties named __proto__, constructor, and prototype\n3. Deploy custom Express body-parser middleware to strip dangerous keys before merging operations\n\n## References\n\n- [GitHub Security Advisory GHSA-mj3g-7xcc-x4vh](https://github.com/phun-ky/defaults-deep/security/advisories/GHSA-mj3g-7xcc-x4vh)\n- [GitHub Pull Request #49](https://github.com/phun-ky/defaults-deep/pull/49)\n- [Fix Commit 807dba9](https://github.com/phun-ky/defaults-deep/commit/807dba930f8718f9126cad59d949b8fd3539b059)\n- [Release Tag v2.0.5](https://github.com/phun-ky/defaults-deep/releases/tag/2.0.5)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-54737) - Automated Vulnerability Intelligence*", "url": "https://gist.github.com/alon710/3afa9bbe175e1dfd1649cd2081ad6eb5"}, {"timestamp": "2026-07-31T18:53:15.831Z", "date_only": false, "value": "2026-07-31T18:53:15.831395Z", "kind": "other", "label": "Recorded", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-54737", "field": "containers.adp.0.metrics.0.other.content.timestamp"}, {"timestamp": "2026-07-31T18:53:15.831Z", "date_only": false, "value": "2026-07-31T18:53:15.831395Z", "kind": "other", "label": "Recorded", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-54737", "record": "FKIE_CVE-2026-54737", "field": "metrics.ssvcV203.0.ssvcData.timestamp"}, {"timestamp": "2026-07-31T19:00:41.074Z", "date_only": false, "value": "2026-07-31T19:00:41.074Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "CVE-2026-54737", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2026-07-31T19:00:41.074Z", "date_only": false, "value": "2026-07-31T19:00:41.074Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-54737", "field": "containers.adp.0.providerMetadata.dateUpdated"}, {"timestamp": "2026-09-10T20:12:43.783Z", "date_only": false, "value": "2026-09-10T20:12:43.783", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-54737", "record": "FKIE_CVE-2026-54737", "field": "lastModified"}]}