Executive brief
merge-objects is a JavaScript library that merges objects together. The library contains a prototype pollution vulnerability that allows attackers to pollute the Object prototype, potentially affecting all objects in an application and leading to unauthorized property modifications or denial of service.
Technical details
The merge-objects library is vulnerable to prototype pollution through unsafe merging of user-supplied objects. The vulnerability exists in all versions of the library, stemming from insufficient validation when merging nested object properties. An attacker can craft malicious input that pollutes the Object.prototype, injecting arbitrary properties that affect all JavaScript objects in the running application. This can lead to denial of service, privilege escalation, or other impacts depending on how the affected application uses the polluted properties. No fix is currently available; users are advised to migrate to alternative packages.
Affected products
- merge-objects merge-objects all versions
Timeline
- 2020-09-01: disclosed