@75lb/deep-merge/.../deep-merge@1.1.0 vulnerabilities

Deep-merge the values of one object structure into another

  • latest version

    1.1.2

  • latest non vulnerable version

  • first published

    3 years ago

  • latest version published

    4 months ago

  • licenses detected

  • Direct Vulnerabilities

    Known vulnerabilities in the @75lb/deep-merge package. This does not include vulnerabilities belonging to this package’s dependencies.

    How to fix?

    Automatically find and fix vulnerabilities affecting your projects. Snyk scans for vulnerabilities and provides fixes for free.

    Fix for free
    VulnerabilityVulnerable Version
    • M
    Improper Restriction of Operations within the Bounds of a Memory Buffer

    @75lb/deep-merge is a Deep-merge the values of one object structure into another

    Affected versions of this package are vulnerable to Improper Restriction of Operations within the Bounds of a Memory Buffer through the merge methods of lodash to merge objects. An attacker can execute arbitrary code or cause a system crash by manipulating the input objects passed to these methods.

    How to fix Improper Restriction of Operations within the Bounds of a Memory Buffer?

    Upgrade @75lb/deep-merge to version 1.1.2 or higher.

    <1.1.2