Vulnerability · Published Apr 20, 2026 · Assigned by VulDB

CVE-2026-66211024bit extend-deep index.js prototype pollution

High 7.3

In plain English

A high-severity prototype pollution in extend-deep from 1024bit. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 27% of all known vulnerabilities).

Severity (CVSS 3.1)7.3High

Exploit odds (30 days)0.3%top 72.9% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

A vulnerability was determined in 1024bit extend-deep up to 0.1.6. The impacted element is an unknown function of the file index.js. This manipulation of the argument __proto__ causes improperly controlled modification of object prototype attributes. Remote exploitation of the attack is possible. The exploit has been publicly disclosed and may be utilized. The code repository of the project has not been active for many years.

Affected products (as reported)

Vendor	Product	Versions
1024bit	extend-deep	0.1.00.1.10.1.20.1.30.1.40.1.50.1.6

Weakness: CWE-1321, CWE-94 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R

References

VDB-358256 | 1024bit extend-deep index.js prototype pollution vdb-entry, technical-description
VDB-358256 | CTI Indicators (IOB, IOC, TTP, IOA) signature, permissions-required
Submit #792387 | 1024bit extend-deep 0.1.6 Prototype Pollution third-party-advisory
https://github.com/sudo-secure/security-research/blob/main/extend-deep/prototype-pollution/PoC.md exploit