CVE-2021-23417: Prototype Pollution in deepmergefn
Summary
CVE-2021-23417: Prototype Pollution in deepmergefn. Affects deepmergefn versions < 1.1.0. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The deepmergefn package is an npm package that provides a deep merging functionality for JavaScript objects. It allows developers to merge multiple objects into a single object, recursively merging nested properties. This package is widely used in JavaScript applications for managing complex object structures. However, all versions of deepmergefn are vulnerable to Prototype Pollution via the deepMerge function.
Vulnerability Detail
Prototype Pollution is a vulnerability that occurs when an attacker can inject or modify properties of an object's prototype. In the case of deepmergefn, the deepMerge function does not properly sanitize user input, allowing an attacker to modify the prototype of an object. This can lead to various security issues, such as arbitrary code execution, denial of service, or data manipulation. The impact of this vulnerability depends on how the affected package is used in the application and the privileges of the user running the application.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
If updating the package is not immediately possible, a temporary workaround is to avoid using the deepMerge function with untrusted input. Developers should carefully validate and sanitize any user input before passing it to the deepMerge function. Additionally, it is recommended to review the usage of deepmergefn in the application and consider alternative libraries or custom implementations that do not have the Prototype Pollution vulnerability.
Conclusion
The deepmergefn package is vulnerable to Prototype Pollution via the deepMerge function. It is recommended to update the package to version 1.1.1 or later to fix this vulnerability. If immediate updating is not possible, developers should validate and sanitize user input before using the deepMerge function. Consideration should also be given to alternative libraries or custom implementations that do not have the Prototype Pollution vulnerability. For further support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for deepmergefn →
FAQ
Prototype Pollution is a vulnerability that allows an attacker to modify an object's prototype, leading to potential security issues.
The deepmergefn package uses the deepMerge function to merge multiple objects into a single object, recursively merging nested properties.
The consequences of the Prototype Pollution vulnerability in deepmergefn can include arbitrary code execution, denial of service, or data manipulation.
Yes, the maintainers of deepmergefn have released a fix in version 1.1.1.
Yes, developers can consider alternative libraries or custom implementations that do not have the Prototype Pollution vulnerability.
