{"action":"Upgrade @phun-ky/defaults-deep to 2.0.5 or later.","affected":[{"fixed":"2.0.5","introduced":"0"}],"component":"@phun-ky/defaults-deep","cve_ids":["CVE-2026-54737"],"ecosystem":"npm","epss":0.00455,"exploited":false,"fixed_versions":["2.0.5"],"ghsa_id":"GHSA-mj3g-7xcc-x4vh","id":"tcs_01M5KG0VXK75YA30FM5ATGMG2E","modified_at":"2026-07-31T18:11:48.291706Z","published_at":"2026-07-31T17:49:08Z","references":["https://osv.dev/vulnerability/GHSA-mj3g-7xcc-x4vh","https://github.com/phun-ky/defaults-deep/security/advisories/GHSA-mj3g-7xcc-x4vh","https://github.com/phun-ky/defaults-deep/pull/49","https://github.com/phun-ky/defaults-deep/commit/807dba930f8718f9126cad59d949b8fd3539b059","https://github.com/phun-ky/defaults-deep","https://github.com/phun-ky/defaults-deep/releases/tag/2.0.5"],"severity":{"label":"high","score":7.3},"sources":[{"source":"osv","source_id":"GHSA-mj3g-7xcc-x4vh","url":"https://osv.dev/vulnerability/GHSA-mj3g-7xcc-x4vh"}],"summary":"@phun-ky/defaults-deep Has a Prototype Pollution issue via Unsafe Recursive Property Merging"}