@75lb/deep-merge Prototype Pollution vulnerability

Description

Prototype Pollution in 75lb deep-merge 1.1.1 allows attackers to execute arbitrary code or cause a Denial of Service (DoS) and cause other impacts via merge methods of lodash to merge objects.

Recommendation

Update the @75lb/deep-merge package to the latest compatible version. Followings are version details:

• Affected version(s): <= 1.1.1
• Patched version(s): 1.1.2

References

• GHSA-28mc-g557-92m7
• CVE-2024-38986
• CWE-1321
• CAPEC-310
• OWASP 2021-A6

Related Issues

• Atro CSRF Middleware Bypass (security.checkOrigin) - CVE-2024-56140
• SillyTavern Web Interface Vulnerable DNS Rebinding - CVE-2025-59159
• Prototype Pollution in lodash (GHSA-p6mc-m468-83gw) - CVE-2020-8203
• Better Call routing bug can lead to Cache Deception - Vulnerability

Tags:

npm

@75lb/deep-merge