Live › vulnerability › CVE-2026-93753
Go to dashboarddeepmerge through 4.3.1 fails to validate keys in mergeObject(), so attacker-supplied source objects can write properties into the prototype of the returned object. Applications that read properties without own-property checks then inherit attacker-chosen values.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-27 21:39 UTC, 0h before NVD. All times on this page are UTC.
Applications that call deepmerge's mergeObject() with source objects that contain attacker-controlled keys, such as parsed JSON or request bodies, and then read properties from the result without own-property checks. Projects that merge only trusted, server-defined configuration are much less exposed. Projects not using deepmerge 4.2.0 to 4.3.1 can skip it.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| deepmerge | npm | >= 4.2.0, <= 4.3.1 | – |
npm ls deepmerge to find the installed version and whether it is a dependency of something elsedeepmerge versions between 4.2.0 and 4.3.1deepmerge to a version later than 4.3.1 (fixed version unknown from sources)Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
deepmerge through 4.3.1 contains a prototype poisoning vulnerability in the mergeObject() function that fails to properly validate keys being written to target objects. Attackers can supply malicious source objects in merge operations to inject attacker-controlled properties into the returned object's prototype, causing applications to inherit unintended values when accessing properties without own-property checks.
This page as .md · .json · in your agent: get_signal("CVE-2026-93753")
GitHub Advisory Database, CC-BY 4.0 · NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.