CVE-2026-93753: deepmerge through 4.3.1 Prototype Poisoning via mergeObject
deepmerge through 4.3.1 contains a prototype poisoning vulnerability i ...
Other sources
Rejected reason: This CVE ID has been rejected because it does not describe a security vulnerability.
— NVD
Affected Software
Event History
Frequently Asked Questions
What does an attacker need to exploit this issue?
The attacker must be able to supply a malicious source object that the application passes into a deepmerge merge operation. The published vector indicates network reachability, low attack complexity, and no required privileges or user interaction.
Which applications are most likely to be exposed?
Applications using npm/deepmerge through version 4.3.1 are exposed when they merge attacker-controlled objects and later access properties without checking that they are own properties. The issue affects values inherited through the returned object's prototype.
How can I assess whether my deployment is affected?
Check whether the application includes npm/deepmerge at version 4.3.1 or earlier. Then identify merge operations that accept untrusted source objects and code paths that rely on property access without own-property checks.
What is the expected security impact?
The reported impact is high integrity impact, with no reported confidentiality or availability impact. Injected prototype properties can cause the application to inherit attacker-controlled values.