@ianwalter/merge Prototype Pollution via `merge` function

Description

All versions of package @ianwalter/merge are vulnerable to Prototype Pollution via the main (merge) function. @ianwalter/merge is deprecated and the maintainer suggests using @generates/merger instead.

Recommendation

No fix is available yet. Followings are affected versions:

• <= 9.0.1

References

• GHSA-42m6-g935-5vmq
• security.snyk.io
• CVE-2021-23397
• CWE-1321
• CAPEC-310
• OWASP 2021-A6

Related Issues

• Prototype Pollution in merge-change - CVE-2021-23421
• mockjs vulnerable to Prototype Pollution via the Util.extend function - CVE-2023-26158
• Prototype pollution in @feathersjs/commons _.merge via JSON-parsed __proto__ - CVE-2026-54335
• Prototype pollution in ag-grid-community via the _.mergeDeep function - ag-grid-enterprise - CVE-2024-38996

You might also like:

How to Secure your NodeJs Express Javascript Application - part 1

How to Secure your NodeJs Express Javascript Application - part 2

10 Secure Coding Best Practices to Follow in Every Project

Tags:

npm

@ianwalter/merge