Executive brief
merge-deep2 is a JavaScript library that recursively merges values in objects. The library contains a prototype pollution vulnerability in its mergeDeep() function that allows attackers to modify object prototypes, potentially affecting the behavior of all objects in an application and compromising data integrity.
Technical details
The vulnerability is a prototype pollution flaw (CWE-1321) in the mergeDeep() function of merge-deep2. An attacker can exploit this by crafting malicious input that modifies the Object prototype when processed by the merge function. The attack requires no authentication and is network-accessible if the application exposes the merging functionality to untrusted input. Successful exploitation allows an attacker to pollute object prototypes, potentially leading to logic bypasses or data corruption across the entire application. All versions up to and including 3.0.6 are affected; users should upgrade to a patched version if available.
Affected products
- npm merge-deep2 up to 3.0.6
Timeline
- 2021-12-16: disclosed: GHSA advisory published