A vulnerability was found in Nodejs mixin-deep, where mixin-deep is vulnerable to Prototype Pollution in versions before 1.3.2 and version 2.0.0. The function mixin-deep could be tricked into adding or modifying properties of Object.prototype using a constructor payload.
Created nodejs-mixin-deep tracking bugs for this issue:
Affects: fedora-all [bug 1795476]
While OpenShift Container Platform (OCP) contains the affected nodejs-mixin-deep code, it's added as a dependency of Kibana 5. Similar issue about prototype pollution  have been fixed, but no known attack vector was found, so we're rating this issue as Low for OCP.
 CVE-2019-10744 https://www.elastic.co/community/security
Red Hat Quay 3.2 uses nodejs-deep-mixin 1.3.2 which has a fix for this vulnerability.
Upstream commits :
nodejs-mixin-deep 1.3.2 : https://github.com/jonschlinkert/mixin-deep/commit/90ee1fab375fccfd9b926df718243339b4976d50
nodejs-mixin-deep 2.0.1 : https://github.com/jonschlinkert/mixin-deep/commit/8f464c8ce9761a8c9c2b3457eaeee9d404fa7af9
In Red Hat Software Collections and Red Hat Enterprise Linux 8, nodejs-mixin-deep is bundled into nodejs-nodemon, and is not meant to be accessed outside of that package. Within nodemon, this flaw is rated with a Low severity.