CVE-2026-25047

9.4 criticalEPSS 0.8%

Critical (9.4) in sharpred deephas. EPSS 0.8% chance of exploitation in the next 30 days. Fixed in deephas 1.0.8.

deepHas provides a test for the existence of a nested object key and optionally returns that key. A prototype pollution vulnerability exists in version 1.0.7 of the deephas npm package that allows an attacker to modify global object behavior. This issue was fixed in version 1.0.8.

Severity

CVSS 4.0

9.4 critical

CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

CVSS 3.1

8.8 high

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

EPSS: 0.8% chance of exploitation in the next 30 days; higher than 56% of CVEs (scores of 2026-10-31)
CWE: CWE-1321
Published: 2026-01-29
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

sharpred:deephas

Packages (OSV)

Advisory	Ecosystem	Package	Affected	Fixed in
GHSA-2733-6c58-pf27	npm	deephas	<1.0.8	1.0.8

References

https://github.com/sharpred/deepHas/commit/8097fafd3776c613d8066546653e0d2c7b5fc465
https://github.com/sharpred/deepHas/security/advisories/GHSA-2733-6c58-pf27

Check your stack JSON