Vulnerability	Vulnerable Version
H Prototype Pollution merge-deep is a recursively merges values in a javascript object. Affected versions of this package are vulnerable to Prototype Pollution. Merge-deep actively attempts to prevent prototype pollution by blocking object property merges into `__proto__`, however it still allows for prototype pollution of Object.prototype via a constructor payload. PoC `var mergeDeep = require("merge-deep"); var payload = '{"constructor": {"prototype": {"isAdmin": true}}}'; mergeDeep({}, JSON.parse(payload));` How to fix Prototype Pollution? Upgrade `merge-deep` to version 3.0.3 or higher.	<3.0.3
M Prototype Pollution merge-deep is a recursively merges values in a javascript object. Affected versions of this package are vulnerable to Prototype Pollution via merging functions. These functions allows a malicious user to modify the prototype of `Object` via `__proto__`, causing the addition or modification of an existing property that will exist on all objects. How to fix Prototype Pollution? Upgrade `merge-deep` to version 3.0.1 or higher.	<3.0.1

Prototype Pollution

merge-deep is a recursively merges values in a javascript object.

Affected versions of this package are vulnerable to Prototype Pollution. Merge-deep actively attempts to prevent prototype pollution by blocking object property merges into __proto__, however it still allows for prototype pollution of Object.prototype via a constructor payload.

PoC

var mergeDeep = require("merge-deep");
var payload = '{"constructor": {"prototype": {"isAdmin": true}}}';
mergeDeep({}, JSON.parse(payload));

How to fix Prototype Pollution?

Upgrade merge-deep to version 3.0.3 or higher.

<3.0.3

Prototype Pollution

merge-deep is a recursively merges values in a javascript object.

Affected versions of this package are vulnerable to Prototype Pollution via merging functions. These functions allows a malicious user to modify the prototype of Object via __proto__, causing the addition or modification of an existing property that will exist on all objects.

How to fix Prototype Pollution?

Upgrade merge-deep to version 3.0.1 or higher.

<3.0.1

Go back to all versions of this package