@ianwalter/merge Prototype Pollution via `merge` function

Description

All versions of package @ianwalter/merge are vulnerable to Prototype Pollution via the main (merge) function. @ianwalter/merge is deprecated and the maintainer suggests using @generates/merger instead.

Recommendation

No fix is available yet. Followings are affected versions:

<= 9.0.1

References

GHSA-42m6-g935-5vmq
security.snyk.io
CVE-2021-23397
CWE-1321
CAPEC-310
OWASP 2021-A6

Could your website be exposed too?

SmartScanner can check your website for @ianwalter/merge Prototype Pollution via `merge` function and gives you actionable findings to investigate.

Start a free scan

Related Issues

Prototype Pollution in merge-change - CVE-2021-23421
mockjs vulnerable to Prototype Pollution via the Util.extend function - CVE-2023-26158
Prototype pollution in @feathersjs/commons _.merge via JSON-parsed __proto__ - CVE-2026-54335
Prototype pollution in ag-grid-community via the _.mergeDeep function - ag-grid-enterprise - CVE-2024-38996

How to Secure your NodeJs Express Javascript Application - part 1

How to Secure your NodeJs Express Javascript Application - part 2

10 Secure Coding Best Practices to Follow in Every Project

See something that needs correcting? Let us knowUpdated January 31, 2023