Executive brief
The merge library is a Node.js utility for combining JavaScript objects. Versions before 1.2.1 contain a prototype pollution flaw that allows attackers to manipulate the core Object prototype through specially crafted input to the recursive merge function, potentially affecting all objects in the application and leading to denial of service or property injection attacks.
Technical details
Prototype pollution in the merge.recursive function allows untrusted input to add or modify properties on the Object prototype. The vulnerability is triggered when merging objects with malicious key names (e.g., "__proto__" or "constructor.prototype"). Since the merge function processes untrusted data without proper safeguards, an attacker can pollute the prototype chain, affecting all object instances. The attack requires network access to supply crafted input to an application using the vulnerable merge library. Versions 1.2.1 and later include fixes to sanitize prototype-related keys.
Affected products
- npm merge before 1.2.1
Timeline
- 2018-11-01: disclosed
- 2018-11-01: patched: Fix available in version 1.2.1