NodeJS/mixin-deep/1.2.0


Deeply mix the properties of objects into the first object. Like merge-deep, but doesn't clone. No dependencies.

https://www.npmjs.com/package/mixin-deep
MIT

3 Security Vulnerabilities

Prototype Pollution in mixin-deep

Published date: 2018-07-26T15:10:54Z
CVE: CVE-2018-3719
Links:

Versions of mixin-deep before 1.3.1 are vulnerable to prototype pollution via merging functions.

Recommendation

Update to version 1.3.1 or later.

Affected versions: ["0.1.0", "1.0.0", "1.0.1", "1.1.0", "1.1.1", "1.1.2", "1.1.3", "1.2.0", "1.3.0"]
Secure versions: [2.0.1, 1.3.2]
Recommendation: Update to version 2.0.1.

Prototype Pollution in mixin-deep

Published date: 2019-08-27T17:42:33Z
CVE: CVE-2019-10746
Links:

Versions of mixin-deep prior to 2.0.1 or 1.3.2 are vulnerable to Prototype Pollution. The mixinDeep function fails to validate which Object properties it updates. This allows attackers to modify the prototype of Object, causing the addition or modification of an existing property on all objects.

Recommendation

If you are using mixin-deep 2.x, upgrade to version 2.0.1 or later. If you are using mixin-deep 1.x, upgrade to version 1.3.2 or later.

Affected versions: ["2.0.0", "0.1.0", "1.0.0", "1.0.1", "1.1.0", "1.1.1", "1.1.2", "1.1.3", "1.2.0", "1.3.0", "1.3.1"]
Secure versions: [2.0.1, 1.3.2]
Recommendation: Update to version 2.0.1.

mixin-deep prototype pollution

Published date: 2018-02-15
CVEs: ["CVE-2018-3719"]
CVSS Score: 1.8
CVSS Vector: CVSS:3.0/AV:L/AC:H/PR:H/UI:R/S:U/C:N/I:N/A:L
Links:

mixin-deep node module before 1.3.1 suffers from a prototype pollution vulnerability via merging functions, which allows a malicious user to modify the prototype of 'Object' via proto, causing the addition or modification of an existing property that will exist on all objects.

Affected versions: ["0.1.0", "1.0.0", "1.0.1", "1.1.0", "1.1.1", "1.1.2", "1.1.3", "1.2.0", "1.3.0"]
Secure versions: [2.0.1, 1.3.2]
Recommendation: Update module to 1.3.1 or higher

13 Other Versions

Version License Security Released
2.0.1 MIT 2019-06-19 - 17:47 almost 5 years
2.0.0 MIT 1 2018-07-11 - 14:11 over 5 years
1.3.2 MIT 2019-06-24 - 20:33 almost 5 years
1.3.1 MIT 1 2018-02-07 - 16:28 about 6 years
1.3.0 MIT 3 2017-12-09 - 06:49 over 6 years
1.2.0 MIT 3 2017-03-02 - 13:40 about 7 years
1.1.3 MIT 3 2015-08-29 - 02:08 over 8 years
1.1.2 MIT 3 2015-08-21 - 06:31 over 8 years
1.1.1 MIT 3 2015-05-28 - 07:48 almost 9 years
1.1.0 MIT 3 2015-04-30 - 00:52 almost 9 years
1.0.1 MIT 3 2015-02-25 - 11:15 about 9 years
1.0.0 MIT 3 2015-02-25 - 11:12 about 9 years
0.1.0 MIT 3 2014-09-22 - 15:35 over 9 years