@75lb/deep-merge Prototype Pollution vulnerability

Description

Prototype Pollution in 75lb deep-merge 1.1.1 allows attackers to execute arbitrary code or cause a Denial of Service (DoS) and cause other impacts via merge methods of lodash to merge objects.

Recommendation

Update the @75lb/deep-merge package to the latest compatible version. Followings are version details:

• Affected version(s): <= 1.1.1
• Patched version(s): 1.1.2

References

• GHSA-28mc-g557-92m7
• CVE-2024-38986
• CWE-1321
• CAPEC-310
• OWASP 2021-A6

Related Issues

• @intlify/shared Prototype Pollution vulnerability (GHSA-hjwq-mjwj-4x6c) - CVE-2024-52810
• @intlify/shared Prototype Pollution vulnerability (GHSA-hjwq-mjwj-4x6c) 3 - CVE-2024-52810
• @intlify/shared Prototype Pollution vulnerability - CVE-2024-52810
• @intlify/shared Prototype Pollution vulnerability (GHSA-hjwq-mjwj-4x6c) 2 - CVE-2024-52810

Tags:

npm

@75lb/deep-merge