The vulnerability is a prototype pollution flaw in the defaults-deep library. Unfiltered recursive merging allows an attacker to add or modify properties on Object.prototype, potentially corrupting all objects that inherit from it. This weakness is identified as CWE-1321 and can undermine application correctness and lead to further attacks such as code execution if malicious prototype data is later used in security‑sensitive logic.

The affected product is the phun-ky defaults-deep JavaScript library, in all releases prior to version 2.0.5. Endpoints that import or depend on this library and accept user‑controlled input objects are at risk. The bug has been fixed in release 2.0.5, which removes prototype, constructor, and prototype properties from the merge process.

The CVSS score of 7.3 indicates a high severity. The EPSS score of less than 1% suggests low current exploitation probability, and the vulnerability is not listed in CISA’s KEV catalog. Inferred from the description, the attack vector is likely remote, through controlled data sent to an application that performs defaultsDeep on it. If exploited, the attacker could alter global object behavior, enabling a range of downstream attacks.