GitHub Advisoryadvisory · npm

GHSA-76g8-235f-gj6p dref is vulnerable to prototype pollution

HIGH Published 2025-09-25 Modified 2025-09-26 Official page ↗

Aliases: CVE-2025-26278
Ecosystem: npm
Packages: dref
Severity: High
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weaknesses: CWE-1321
Reviewed: 2025-09-26

Affected packages

• npm dref: <= 0.1.2 (no fix yet)

Description

A prototype pollution in the lib.set function of dref v0.1.2 allows attackers to cause a Denial of Service (DoS) via supplying a crafted payload.

Related

Alias · CVE (1)

CVE-2025-26278 A prototype pollution in the lib.set function of dref v0.1.2 allows attackers to cause a Denial of Service (DoS) via supplying a crafted… vulnerability

Weakness · CWE (1)

CWE-1321 Improperly Controlled Modification of Object Prototype Attributes weakness

References