CVE-2026-46681
Received Received - Intake

Prototype Pollution in @nevware21/ts-utils

Publication date: 2026-07-21

Last updated on: 2026-07-21

Assigner: GitHub, Inc.

Description
@nevware21/ts-utils is a comprehensive TypeScript/JavaScript utility library. Prior to version 0.14.0, the _copyProps function in lib/src/object/copy.ts uses for...in to iterate over source object properties without an Object.hasOwnProperty check, and does not filter dangerous keys (__proto__, constructor, prototype). This allows an attacker to pollute the prototype chain of all objects in the application. Version 0.14.0 patches the issue.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-21
Last Modified
2026-07-21
Generated
2026-07-21
AI Q&A
2026-07-21
EPSS Evaluated
N/A
NVD
CVE-2026-46681
EUVD
EUVD-2026-46260

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
nevware21 ts-utils to 0.14.0 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-1321 The product receives input from an upstream component that specifies attributes that are to be initialized or updated in an object, but it does not properly control modifications of attributes of the object prototype.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-46681 is a Prototype Pollution vulnerability in the @nevware21/ts-utils library affecting versions before 0.14.0. The _copyProps function uses a for...in loop without checking Object.hasOwnProperty or filtering dangerous keys like __proto__, constructor, and prototype. This allows attackers to manipulate the prototype chain of all objects in an application by providing malicious input.

Detection Guidance

To detect this vulnerability, check if your application uses @nevware21/ts-utils version <= 0.13.0. Run: npm list @nevware21/ts-utils. If vulnerable, inspect code for _copyProps usage in lib/src/object/copy.ts without Object.hasOwnProperty checks or dangerous key filtering.

Impact Analysis

This vulnerability enables attackers to pollute the prototype chain, potentially leading to arbitrary code execution, data tampering, or denial of service. It can affect all objects in an application, compromising security and stability. Users of affected versions should update to version 0.14.0 or later.

Compliance Impact

Prototype pollution vulnerabilities like CVE-2026-46681 can lead to unauthorized data access or modification, which may violate GDPR's data integrity and security requirements (Article 32) or HIPAA's safeguards for protected health information. Attackers could exploit this to manipulate application behavior or exfiltrate sensitive data, potentially causing compliance breaches.

Mitigation Strategies

Immediately update @nevware21/ts-utils to version 0.14.0 or later using: npm update @nevware21/ts-utils. Review and remove any custom _copyProps implementations that lack prototype pollution protections.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-46681. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart