@phun-ky/defaults-deep is a library like lodash defaultsDeep with array preservation and no lodash dependency. Prior to 2.0.5, defaultsDeep() recursively merges user-supplied objects without filtering proto, constructor, and prototype, allowing properties to be written to Object.prototype. This issue is fixed in version 2.0.5.

Affected: npm: @phun-ky/defaults-deep

### Impact

A prototype pollution vulnerability exists in @phun-ky/defaults-deep prior to version 2.0.5.

The library recursively merged user-supplied objects without filtering unsafe property names such as `__proto__`, `constructor`, and `prototype`. An attacker able to supply crafted input could cause properties to be written to `Object.prototype`, resulting in prototype pollution affecting all objects within the running process.

Applications that pass untrusted input to `defaultsDeep()` may be impacted. Depending on how the application uses merged objects, this could lead to unexpected behavior, logic bypasses, denial of service, or other security issues.

### Patches

This issue has been fixed in version 2.0.5.

Users should upgrade to version 2.0.5 or later.

The fix prevents unsafe prototype-related keys (`__proto__`, `constructor`, and `prototype`) from being processed during recursive merge operations and includes regression tests covering known prototype pollution vectors.

### Workarounds

Users unable to upgrade should ensure that untrusted input is sanitized before being passed to `defaultsDeep()`.

At a minimum, applications should reject or remove the following property names from all levels of user-controlled objects:

- `__proto__` - `constructor` - `prototype`

Upgrading to a patched version remains the recommended mitigation.