Executive brief
The @theecryptochad/merge-guard library, a utility for merging JavaScript objects, is vulnerable to prototype pollution. An attacker can provide specially crafted data to the deepMerge function to modify the behavior of all objects within the application. This can lead to privilege escalation, bypass of security logic, or application instability.
Technical details
The deepMerge() function in @theecryptochad/merge-guard recursively merges two objects without sanitizing reserved property keys such as __proto__, constructor, and prototype. By injecting a __proto__ key into the source object, an attacker can mutate Object.prototype in the Node.js runtime. This vulnerability is reachable if the application processes untrusted JSON input (e.g., from HTTP requests or WebSockets) through the deepMerge function. Successful exploitation allows for arbitrary property injection, which can be leveraged for privilege escalation or logic bypass. The issue is fixed in version 1.0.1 by implementing a blocklist for sensitive keys.
Affected products
- TheeCryptoChad @theecryptochad/merge-guard < 1.0.1
Timeline
- 2026-05-06: patched: Fix commit and initial publication by author
- 2026-05-11: advisory: Published to GitHub Advisory Database
References
- https://api.github.com/users/TheeCryptoChad
- https://github.com/TheeCryptoChad
- https://api.github.com/users/TheeCryptoChad/gists%7B/gist_id%7D
- https://api.github.com/users/TheeCryptoChad/repos
- https://avatars.githubusercontent.com/u/54559164?v=4
- https://api.github.com/users/TheeCryptoChad/events%7B/privacy%7D