CVE-2026-93753: deepmerge through 4.3.1 Prototype Poisoning via mergeObject
deepmerge through 4.3.1 contains a prototype poisoning vulnerability in the mergeObject() function that fails to properly validate keys being written to target objects. Attackers can supply malicious source objects in merge operations to inject attacker-controlled properties into the returned object's prototype, causing applications to inherit unintended values when accessing properties without own-property checks.
Affected Software
Event History
Frequently Asked Questions
What does an attacker need to exploit this issue?
The attacker must be able to supply a malicious source object that the application passes into a deepmerge merge operation. The published vector indicates network reachability, low attack complexity, and no required privileges or user interaction.
Which applications are most likely to be exposed?
Applications using npm/deepmerge through version 4.3.1 are exposed when they merge attacker-controlled objects and later access properties without checking that they are own properties. The issue affects values inherited through the returned object's prototype.
How can I assess whether my deployment is affected?
Check whether the application includes npm/deepmerge at version 4.3.1 or earlier. Then identify merge operations that accept untrusted source objects and code paths that rely on property access without own-property checks.
What is the expected security impact?
The reported impact is high integrity impact, with no reported confidentiality or availability impact. Injected prototype properties can cause the application to inherit attacker-controlled values.