Prototype Pollution in lodash.merge (GHSA-h726-x36v-rx45)

Description

Versions of lodash.merge before 4.6.2 are vulnerable to prototype pollution. The function merge may allow a malicious user to modify the prototype of Object via {constructor: {prototype: {...}}} causing the addition or modification of an existing property that will exist on all objects.

Recommendation

Update the lodash.merge package to the latest compatible version. Followings are version details:

• Affected version(s): < 4.6.2
• Patched version(s): 4.6.2

References

• GHSA-h726-x36v-rx45
• www.npmjs.com
• CWE-1321

Related Issues

• Improper Request Caching Lookup in the Auth0 Next.js SDK - CVE-2025-67490
• authkit-nextjs may let session cookies be cached in CDNs - CVE-2025-64762
• @perfood/couch-auth may expose session tokens, passwords - CVE-2025-60794
• undici Denial of Service attack via bad certificate data - CVE-2025-47279

Tags:

npm

lodash.merge