Prototype Poisoning in deepmerge Affects Applications Using Merge Functionality

CVE-2026-93753

What is CVE-2026-93753?

The deepmerge library, specifically versions up to 4.3.1, is vulnerable to a significant prototype poisoning issue. This vulnerability arises in the mergeObject() function, where the lack of adequate validation of keys allows attackers to inject malicious properties into the target objects' prototype. As a result, any application utilizing deepmerge may inadvertently inherit these unwanted properties, leading to potential security risks, especially when properties are accessed without the necessary checks for ownership.

References