PatchTheCVECVE-2022-31106: Underscore.deep is a collection of Underscore mixins that operate on nested objects
CVE-2022-31106 is a high-severity flaw (CVSS 8.3) affecting underscore.deep. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.
Underscore.deep is a collection of Underscore mixins that operate on nested objects. Versions of `underscore.deep` prior to version 0.5.3 are vulnerable to a prototype pollution vulnerability. An attacker can craft a malicious payload and pass it to `deepFromFlat`, which would pollute any future Objects created. Any users that have `deepFromFlat` or `deepPick` (due to its dependency on `deepFromFlat`) in their code should upgrade to version 0.5.3
Why this priority
- High severity
- Public exploit reference
- Remotely exploitable, no login, no user action
A fixed release or distro patch exists.
Last updated 2026-06-17 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score
Am I affected?
Timeline
- Published CVE record published
- Updated Record last modified
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Quick answers
How do I fix CVE-2022-31106?
underscore.deep: upgrade to 0.5.3. Exact commands for each OS are on this page.
Is CVE-2022-31106 being exploited?
CVE-2022-31106 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.
What does CVE-2022-31106 affect?
CVE-2022-31106 affects underscore.deep. Severity is high (CVSS 8.3). Underscore.deep is a collection of Underscore mixins that operate on nested objects. Versions of `underscore.deep` prior to version 0.5.3 are vulnerable to a prototype pollution vulnerability. An attacker can craft a malicious payload and p
How urgent is CVE-2022-31106?
Priority 55/100. High severity; Public exploit reference; Remotely exploitable, no login, no user action