Description
Versions of the package algoliasearch-helper from 2.0.0-rc1 and before 3.11.2 are vulnerable to Prototype Pollution in the _merge() function in merge.js, which allows constructor.prototype to be written even though doing so throws an error.
Recommendation
Update the algoliasearch-helper package to the latest compatible version. Followings are version details:
- Affected version(s): >= 2.0.0-rc1, < 3.11.2
- Patched version(s): 3.11.2
References
Could your website be exposed too?
SmartScanner can check your website for algoliasearch-helper is vulnerable to Prototype Pollution in _merge() and gives you actionable findings to investigate.
Start a free scanRelated Issues
- rollbar vulnerable to Prototype Pollution in merge() - CVE-2025-62517
- Prototype Pollution in algoliasearch-helper - CVE-2021-23433
- axios Vulnerable to Credential Theft and Response Hijacking via Prototype Pollution Gadget in Config Merge - CVE-2026-44495
- mpregular vulnerable to prototype pollution - CVE-2025-57323
You might also like:
See something that needs correcting? Let us knowUpdated September 30, 2025