CVE-2018-3722: Prototype Pollution in merge-deep
Summary
CVE-2018-3722: Prototype Pollution in merge-deep. Affects merge-deep versions < 3.0.1. Fixed in 3.0.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
merge-deep is an npm package that provides a function for merging JavaScript objects deeply. It is commonly used to combine multiple objects into a single object, with the values of the later objects overwriting the values of the earlier objects. This package is vulnerable to prototype pollution, which is a vulnerability that allows an attacker to modify the prototype of an object and potentially execute arbitrary code or modify the behavior of the application.
Vulnerability Detail
The vulnerability in merge-deep arises from the improper handling of merging functions. Versions of merge-deep prior to 3.0.1 are affected. An attacker can exploit this vulnerability by providing a specially crafted object with a malicious prototype. When this object is merged with other objects using merge-deep, the malicious prototype can be injected into the resulting object, leading to prototype pollution. The impact of this vulnerability can vary depending on how the merged object is used in the application. It could potentially lead to remote code execution, data manipulation, or denial of service.
How To Fix
Minimum fixed version
3.0.1
This is the first release that contains the fix.
npm install merge-deep@3.0.1Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
The merge-deep package prior to version 3.0.1 is vulnerable to prototype pollution. It is important to update to the latest version to mitigate the risk of this vulnerability. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for merge-deep →
FAQ
Prototype pollution is a vulnerability that allows an attacker to modify the prototype of an object, which can lead to arbitrary code execution or modification of application behavior.
The merge-deep package prior to version 3.0.1 does not properly handle merging functions, which can result in prototype pollution.
The impact of this vulnerability can vary depending on how the merged object is used in the application. It could potentially lead to remote code execution, data manipulation, or denial of service.
You can use the Vulert Playground at Vulert Scanner to check if your application is affected by this vulnerability. Simply provide your package-lock.json file and the playground will analyze it for vulnerabilities.
There is no known workaround for this vulnerability. It is recommended to update merge-deep to the latest version to fix the issue.
Related vulnerabilities
Recent vulnerabilities recorded for merge-deep.
Follow Vulert in Google
Get more Vulert vulnerability and dependency-security updates in Google Search and AI results.