CVE-2026-25047

critical · 9.4

deepHas provides a test for the existence of a nested object key and optionally returns that key. A prototype pollution vulnerability exists in version 1.0.7 of the deephas npm package that allows an attacker to modify global object behavior. This issue was fixed in version 1.0.8.

9.4

CVSS

0.7%

EPSS (exploit prob.)

53rd

EPSS percentile

2026-01-29

Published

CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Weaknesses

CWE-1321

Affected products

Vendor	Product	Affected versions
sharpred	deephas	1.0.7

Check a specific version with /api/v1/cve/match.

References

https://github.com/sharpred/deepHas/commit/8097fafd3776c613d8066546653e0d2c7b5fc465
https://github.com/sharpred/deepHas/security/advisories/GHSA-2733-6c58-pf27

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2026-25047