Executive brief
@theecryptochad/merge-guard is a JavaScript library for merging objects. Versions before 1.0.1 contain a prototype pollution vulnerability in its deepMerge() function that allows attackers to inject malicious properties into JavaScript's Object.prototype when processing untrusted input, potentially enabling privilege escalation and logic bypass across all objects in a Node.js application.
Technical details
The deepMerge() function recursively merges two objects but fails to sanitize reserved property keys like __proto__, constructor, and prototype. When a source object contains a __proto__ key, its value is merged into the target object's __proto__, which JavaScript engines interpret as a write to Object.prototype itself. An attacker who can control the source object (e.g., via user-supplied JSON from HTTP requests or WebSocket messages) can inject arbitrary properties onto Object.prototype, affecting all objects in the runtime. The vulnerability is network-reachable with no authentication or user interaction required. A fix is available in version 1.0.1, which adds an explicit blocklist preventing merge of these reserved keys.
Affected products
- TheeCryptoChad merge-guard < 1.0.1
Timeline
- 2026-05-11: disclosed
- 2026-05-11: patched: Fix available in version 1.0.1