Description
The _.merge(target, source) utility exported by @feathersjs/commons recursively merges source into target by iterating Object.keys(source). When source was produced by JSON.parse and contains a __proto__ (or constructor / prototype) key, that key is returned as an own-enumerable property.
Recommendation
Update the @feathersjs/commons package to the latest compatible version. Followings are version details:
- Affected version(s): <= 5.0.44
- Patched version(s): 5.0.45
References
Could your website be exposed too?
SmartScanner can check your website for Prototype pollution in @feathersjs/commons _.merge via JSON-parsed __proto__ and gives you actionable findings to investigate.
Start a free scanRelated Issues
- axios Vulnerable to Credential Theft and Response Hijacking via Prototype Pollution Gadget in Config Merge - CVE-2026-44495
- LangSmith Client SDKs has Prototype Pollution in langsmith-sdk via Incomplete `__proto__` Guard in Internal lodash `set( - CVE-2026-40190
- Axios: Invisible JSON Response Tampering via Prototype Pollution Gadget in `parseReviver` - CVE-2026-42044
- axios has DoS & Header Injection via Prototype Pollution Read-Side Gadgets in axios merge functions - CVE-2026-44490
You might also like:
See something that needs correcting? Let us knowUpdated July 14, 2026