Prototype pollution in @feathersjs/commons _.merge via JSON-parsed __proto__

Description

The _.merge(target, source) utility exported by @feathersjs/commons recursively merges source into target by iterating Object.keys(source). When source was produced by JSON.parse and contains a __proto__ (or constructor / prototype) key, that key is returned as an own-enumerable property.

Recommendation

Update the @feathersjs/commons package to the latest compatible version. Followings are version details:

• Affected version(s): <= 5.0.44
• Patched version(s): 5.0.45

References

• GHSA-28xv-ph75-77wh
• CVE-2026-54335
• CWE-1321
• CAPEC-310
• OWASP 2021-A6

Related Issues

• axios Vulnerable to Credential Theft and Response Hijacking via Prototype Pollution Gadget in Config Merge - CVE-2026-44495
• LangSmith Client SDKs has Prototype Pollution in langsmith-sdk via Incomplete `__proto__` Guard in Internal lodash `set( - CVE-2026-40190
• Axios: Invisible JSON Response Tampering via Prototype Pollution Gadget in `parseReviver` - CVE-2026-42044
• axios has DoS & Header Injection via Prototype Pollution Read-Side Gadgets in axios merge functions - CVE-2026-44490

You might also like:

How to Secure your NodeJs Express Javascript Application - part 1

How to Secure your NodeJs Express Javascript Application - part 2

10 Secure Coding Best Practices to Follow in Every Project

Tags:

npm

@feathersjs/commons