CVE-2026-6621: 1024bit extend-deep index.js prototype pollution

Severity: high (CVSS 7.3 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-04-20 · updated 2026-10-26
Weakness: CWE-94

Description

A vulnerability was determined in 1024bit extend-deep up to 0.1.6. The impacted element is an unknown function of the file index.js. This manipulation of the argument __proto__ causes improperly controlled modification of object prototype attributes. Remote exploitation of the attack is possible. The exploit has been publicly disclosed and may be utilized. The code repository of the project has not been active for many years.

Affected products

1024bit extend-deep: 0.1.0, 0.1.1, 0.1.2, 0.1.3, 0.1.4, 0.1.5 (+1)

References

https://github.com/sudo-secure/security-research/blob/main/extend-deep/prototype-pollution/PoC.md
https://vuldb.com/submit/792387
https://vuldb.com/vuln/358256
https://vuldb.com/vuln/358256/cti

Get alerted when CVE-2026-6621 or the next vulnerability affects your stack