CVE-2026-93753 — deepmerge through 4.3.1 Prototype Poisoning via mergeObject
deepmerge through 4.3.1 contains a prototype poisoning vulnerability in the mergeObject() function that fails to properly validate keys being written to target objects. Attacker…
Published: 2026-09-18 · CVSS: 8.7 · CVSS 4.0
deepmerge through 4.3.1 contains a prototype poisoning vulnerability in the mergeObject() function that fails to properly validate keys being written to target objects. Attackers can supply malicious source objects in merge operations to inject attacker-controlled properties into the returned object's prototype, causing applications to inherit unintended values when accessing properties without own-property checks.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7