Prototype Pollution in merge-change

Description

All current versions of package merge-change are vulnerable to Prototype Pollution via the utils.set function.

Recommendation

No fix is available yet. Followings are affected versions:

• <= 1.8.1

References

• GHSA-f9cv-665r-275h
• snyk.io
• CVE-2021-23421
• CWE-915
• CAPEC-310
• OWASP 2021-A6
• OWASP 2021-A8

Related Issues

• @ianwalter/merge Prototype Pollution via `merge` function - CVE-2021-23397
• Prototype Pollution in the merge and clone helper methods - CVE-2021-39227
• merge vulnerable to Prototype Pollution - CVE-2021-3645
• json-schema is vulnerable to Prototype Pollution - CVE-2021-3918

You might also like:

How to Secure your NodeJs Express Javascript Application - part 1

How to Secure your NodeJs Express Javascript Application - part 2

10 Secure Coding Best Practices to Follow in Every Project

Tags:

npm

merge-change