CVE-2021-26707: Prototype Pollution in merge-deep
Summary
CVE-2021-26707: Prototype pollution in Merge-deep. Affects merge-deep versions < 3.0.3. Fixed in 3.0.3. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
merge-deep is a Node.js library used for deep merging objects. It allows developers to merge multiple objects into a single object, combining their properties. This library is commonly used in Node.js applications to handle complex object merging operations. However, versions before 3.0.3 are vulnerable to prototype pollution attacks.
Vulnerability Detail
The vulnerability in merge-deep (versions before 3.0.3) allows an attacker to manipulate the prototype of Object and introduce or overwrite properties. By exploiting this vulnerability, an attacker can pollute the prototype chain, leading to unexpected behavior and potential security issues in applications that use this library. This can result in arbitrary code execution, data tampering, or denial of service.
How To Fix
Latest published version: 3.0.3 as of 23 Oct 2026
npm install merge-deep@3.0.3The newest release already contains this fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is recommended to update to the fixed version of merge-deep as soon as possible.
Conclusion
The vulnerability in merge-deep (versions before 3.0.3) allows for prototype pollution attacks, which can have severe consequences such as arbitrary code execution or data tampering. It is crucial for developers to update their merge-deep dependency to version 3.0.3 or later to mitigate this vulnerability. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for merge-deep →
FAQ
merge-deep is a Node.js library used for deep merging objects. It allows developers to combine properties from multiple objects into a single object.
Prototype pollution is a vulnerability that occurs when an attacker can modify the prototype of an object, leading to unexpected behavior and potential security issues.
This vulnerability can lead to arbitrary code execution, data tampering, or denial of service, depending on how it is exploited.
You can use Vulert Playground (https://vulert.com/scanner) to check if your application is affected by this vulnerability. It analyzes your package-lock.json file and provides real-time alerts for open-source vulnerabilities.
No, there is no known workaround for this vulnerability. It is recommended to update to the fixed version of merge-deep.
Related vulnerabilities
Recent vulnerabilities recorded for merge-deep.
