Prototype Pollution Vulnerability in Node.js Library Merge-Deep

CVE-2021-26707

What is CVE-2021-26707?

The merge-deep library for Node.js, prior to version 3.0.3, is susceptible to a prototype pollution vulnerability. This flaw allows an attacker to manipulate the Object.prototype, enabling unauthorized overwriting of existing properties or the addition of new ones. As a result, these changes are inherited by all objects created thereafter, potentially enabling various attacks against applications that utilize this library. This vulnerability presents significant risks to application integrity by allowing malicious actors to inject or corrupt data structures.

References