Exploit discussion active in current signal (2 latest mentions)
Recommended action window: High priority (within 72h)
NVD description
deepHas provides a test for the existence of a nested object key and optionally returns that key. A prototype pollution vulnerability exists in version 1.0.7 of the deephas npm package that allows an attacker to modify global object behavior. This issue was fixed in version 1.0.8.
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
AVAILABLE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
1 version affected across 1 product
| Date | Total | Labels |
|---|
| 2026-01-29 | 2 | Disclosure2 |
| 2026-01-30 | 2 | Disclosure1Patch1 |
A Prototype Pollution vulnerability (CVE-2026-25047) affects deephas prior to version 1.0.8. Upgrade to mitigate the risk. #deephas #PrototypePollution #infosec https://www.pulsepatch.io/posts/cve-2026-25047-deephas-prototype-pollution
Post summary
The post warns of a Prototype Pollution flaw in deephas before 1.0.8 and advises upgrading to mitigate the risk.
CVE-2026-25047 Prototype Pollution Vulnerability in deepHas npm Package Version ... https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-25047 Vulnerability Alert Subscriptions: https://alerts.vulmon.com/?utm_source=twitter&utm_medium=social&utm_campaign=2102281&utm_content=1
Post summary
A newly disclosed prototype pollution vulnerability in the deepHas npm package (CVE‑2026‑25047) is highlighted with a link for further details, but no exploits, patches, or PoC are provided.
CVE-2026-25047 deepHas provides a test for the existence of a nested object key and optionally returns that key. A prototype pollution vulnerability exists in version 1.0.7 of the d… https://www.cve.org/CVERecord?id=CVE-2026-25047
Post summary
CVE-2026-25047 is disclosed as a prototype pollution flaw in deepHas v1.0.7, with basic technical details but no evidence of exploitation or patch availability.
🚨 CVE-2026-25047: deepHas vulnerable to Prototype ... Prototype pollution in deepHas v1.0.7 exploits object key testing to inject malicious properties via constructor.protot... https://zerodaysignal.com/vulnerability/CVE-2026-25047 #netsec #vulnerability #CVE #sysadmin #zeroday
Post summary
The post announces a prototype pollution vulnerability in deepHas v1.0.7 (CVE-2026-25047) and provides a link likely containing further details, but does not mention an exploit, patch, or active exploitation.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | sharpred | deephas | 1.0.7 | node.js | - |