GitHub Advisoryadvisory · npm

GHSA-f9cm-qmx5-m98h Prototype Pollution in merge

HIGH Published 2018-11-01 Modified 2023-09-07 Official page ↗
Aliases
CVE-2018-16469
Ecosystem
npm
Packages
merge
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weaknesses
CWE-1321, CWE-400
Reviewed
2020-06-16

Affected packages

• npm merge: < 1.2.1 → fixed in 1.2.1

Description

Versions of `merge` before 1.2.1 are vulnerable to prototype pollution. The `merge.recursive` function can be tricked into adding or modifying properties of the Object prototype. Recommendation Update to version 1.2.1 or later.

Related

Alias · CVE (1)

  • CVE-2018-16469 The merge.recursive function in the merge package <1.2.1 can be tricked into adding or modifying properties of the Object prototype. vulnerability

Weakness · CWE (2)

  • CWE-1321 Improperly Controlled Modification of Object Prototype Attributes weakness
  • CWE-400 Uncontrolled Resource Consumption weakness

References