Prototype Pollution in deepmergefn

Description

All versions of package deepmergefn are vulnerable to Prototype Pollution via deepMerge function.

Recommendation

No fix is available yet. Followings are affected versions:

• <= 1.1.0

References

• GHSA-vj72-mwrj-m2xq
• snyk.io
• CVE-2021-23417
• CWE-1321
• CWE-915
• CAPEC-310
• OWASP 2021-A6
• OWASP 2021-A8

Related Issues

• Prototype Pollution in the merge and clone helper methods - CVE-2021-39227
• mootools-more vulnerable to prototype pollution - CVE-2021-20088
• Prototype Pollution in js-data - js-data - CVE-2021-23574
• Prototype Pollution in cookiex/deep - CVE-2021-23442

You might also like:

How to Secure your NodeJs Express Javascript Application - part 1

How to Secure your NodeJs Express Javascript Application - part 2

10 Secure Coding Best Practices to Follow in Every Project

Tags:

npm

deepmergefn