CVE-2018-3722: High severity merge-deep vulnerability
merge-deep node module before 3.0.1 suffers from a Modification of Assumed-Immutable Data (MAID) vulnerability, which allows a malicious user to modify the prototype of "Object" via proto, causing the addition or modification of an existing property that will exist on all objects.
Other sources
Versions of merge-deep before 3.0.1 are vulnerable to prototype pollution via merging functions.
Recommendation
Update to version 3.0.1 or later.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is CVE-2018-3722?
CVE-2018-3722 is a vulnerability in the merge-deep node module before version 3.0.1 that is susceptible to prototype pollution via merging functions.
What is the severity of CVE-2018-3722?
The severity of CVE-2018-3722 is high, with a severity value of 8.8.
How does CVE-2018-3722 impact software using merge-deep?
CVE-2018-3722 allows a malicious user to modify the prototype of "Object" via __proto__, causing the addition or modification of an existing property that will exist on all objects.
Which software versions are affected by CVE-2018-3722?
Versions of merge-deep before 3.0.1 are affected by CVE-2018-3722.
How can I fix CVE-2018-3722?
To fix CVE-2018-3722, update merge-deep to version 3.0.1 or later.