ts-deepmerge before 2.0.2 vulnerable to Prototype Pollution

Description

The package ts-deepmerge before version 2.0.2 is vulnerable to Prototype Pollution due to missing sanitization of the merge function.

Recommendation

Update the ts-deepmerge package to the latest compatible version. Followings are version details:

Affected version(s): < 2.0.2
Patched version(s): 2.0.2

References

GHSA-7qqq-gh2f-wq76
security.snyk.io
CVE-2022-25907
CWE-1321
CAPEC-310
OWASP 2021-A6

Could your website be exposed too?

SmartScanner can check your website for ts-deepmerge before 2.0.2 vulnerable to Prototype Pollution and gives you actionable findings to investigate.

Start a free scan

Related Issues

steal vulnerable to Prototype Pollution - CVE-2022-37258
Grunt-karma vulnerable to prototype pollution - CVE-2022-37602
Prototype pollution in Plist before 3.0.5 can cause denial of service - CVE-2022-22912
deep-parse-json vulnerable to Prototype Pollution - CVE-2022-42743

How to Secure your NodeJs Express Javascript Application - part 1

How to Secure your NodeJs Express Javascript Application - part 2

10 Secure Coding Best Practices to Follow in Every Project

See something that needs correcting? Let us knowUpdated January 27, 2023