Executive brief
deepmergefn is a Node.js library for merging nested JavaScript objects. A prototype pollution vulnerability in the deepMerge function allows attackers to inject arbitrary properties into JavaScript object prototypes, potentially affecting the behavior of all objects in an application and enabling object manipulation attacks.
Technical details
The deepmergefn library is vulnerable to prototype pollution in its deepMerge function due to insufficient input validation when merging objects. An attacker can craft malicious input containing special keys like "__proto__", "constructor", or "prototype" to inject properties into the Object prototype chain. This vulnerability requires network access and a specific merge pattern but no authentication. Successful exploitation allows an attacker to pollute the prototype of all objects in the application, potentially modifying behavior, bypassing security checks, or causing denial of service. The vulnerability affects all versions up to and including 1.1.0; patched versions have not been publicly released.
Affected products
- deepmergefn deepmergefn up to 1.1.0
Timeline
- 2021-08-10: disclosed
- 2021-07-28: advisory: NVD published