Executive brief
deepmerge is a JavaScript library used to merge complex objects. A prototype poisoning flaw in the mergeObject() function allows attackers to inject malicious properties into object prototypes, causing applications to inherit unintended values and potentially allowing unauthorized access to sensitive data or application logic.
Technical details
The mergeObject() function in deepmerge fails to properly validate keys before writing them to target objects, allowing attackers to poison the prototype chain. An attacker can supply specially crafted source objects in merge operations to inject properties like __proto__ or constructor.prototype, affecting any code that accesses properties without explicit own-property checks. The vulnerability requires the library to be called with attacker-controlled input but does not require authentication or user interaction.
Affected products
- TehShrike deepmerge through 4.3.1
Timeline
- 2026-09-18: disclosed