{"id":"CVE-2026-93753","kind":"vulnerability","aliases":["CVE-2026-93753","GHSA-gcqx-w48m-w2h4"],"related":[],"title":"deepmerge mergeObject() allows prototype poisoning of returned objects","description":"deepmerge through 4.3.1 contains a prototype poisoning vulnerability in the mergeObject() function that fails to properly validate keys being written to target objects. Attackers can supply malicious source objects in merge operations to inject attacker-controlled properties into the returned object's prototype, causing applications to inherit unintended values when accessing properties without own-property checks.","summary":"deepmerge through 4.3.1 fails to validate keys in mergeObject(), so attacker-supplied source objects can write properties into the prototype of the returned object. Applications that read properties without own-property checks then inherit attacker-chosen values.","severity":"high","cvss":8.7,"epss":0.00514,"exploited":false,"exploited_at":null,"products":[{"name":"deepmerge","fixed":[],"affected":">= 4.2.0, <= 4.3.1","ecosystem":"npm"}],"ecosystems":["npm"],"tags":["cwe-1321","deepmerge","node","npm","package"],"not_affected_if":["default-config","trusted-input-only"],"how_to_check":"- Run `npm ls deepmerge` to find the installed version and whether it is a dependency of something else\n- Check the lockfile for `deepmerge` versions between `4.2.0` and `4.3.1`","fix":"- Upgrade `deepmerge` to a version later than `4.3.1` (fixed version unknown from sources)\n- Until upgraded, do not pass untrusted input as source objects to mergeObject()","status":"open","published_at":"2026-09-18T18:18:34+00:00","first_seen_at":"2026-10-27T21:39:56+00:00","triaged_at":"2026-10-27T21:40:43+00:00","updated_at":"2026-10-27T21:59:20+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-27T21:40:43Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade `deepmerge` to a version later than `4.3.1` (fixed version unknown from sources)\n- Until upgraded, do not pass untrusted input as source objects to mergeObject()","reach":"unknown","title":"deepmerge: mergeObject() lets attackers poison returned objects' prototypes","impact":"medium","summary":"deepmerge through 4.3.1 fails to validate keys in mergeObject(), so attacker-supplied source objects can write properties into the prototype of the returned object. Applications that read properties without own-property checks then inherit attacker-chosen values.","category":"package","nicknames":[],"who_cares":["npm","node","deepmerge"],"confidence":0.6,"needs_auth":"unknown","worst_case":"Attacker-chosen properties appear on merged objects, altering application logic","analyst_note":"Confirm the fixed version and whether the attack needs untrusted input at the merge call, via GHSA-gcqx-w48m-w2h4 on GitHub advisories.","how_to_check":"- Run `npm ls deepmerge` to find the installed version and whether it is a dependency of something else\n- Check the lockfile for `deepmerge` versions between `4.2.0` and `4.3.1`","needs_analyst":true,"not_affected_if":["default-config","trusted-input-only"],"who_is_affected":"Applications that call deepmerge's mergeObject() with source objects that contain attacker-controlled keys, such as parsed JSON or request bodies, and then read properties from the result without own-property checks. Projects that merge only trusted, server-defined configuration are much less exposed. Projects not using deepmerge 4.2.0 to 4.3.1 can skip it.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000652,"input_tokens":3389,"output_tokens":626,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-1321':22B '-2026':10A,18A '-93753':11A,19A '4.3.1':29B,69C 'access':118C 'allow':3A 'applic':52B,112C 'attack':38B,64B,90C,102C 'attacker-chosen':63B 'attacker-control':101C 'attacker-suppli':37B 'caus':111C 'check':60B,124C 'chosen':65B 'contain':70C 'control':103C 'cve':9A,17A 'cwe':21B 'deepmerg':1A,23B,27B,67C 'deepmerge':20A 'fail':30B,80C 'function':78C 'gcqx':14A 'ghsa':13A 'ghsa-gcqx-w48m-w2h4':12A 'inherit':62B,114C 'inject':100C 'key':33B,84C 'malici':93C 'merg':97C 'mergeobject':2A,35B,77C 'node':24B 'npm':25B 'object':8A,41B,51B,89C,95C,108C 'oper':98C 'own-properti':57B,121C 'packag':26B 'poison':5A,73C 'proper':82C 'properti':44B,55B,59B,104C,119C,123C 'prototyp':4A,47B,72C,110C 'read':54B 'return':7A,50B,107C 'sourc':40B,94C 'suppli':39B,92C 'target':88C 'unintend':115C 'valid':32B,83C 'valu':66B,116C 'vulner':74C 'w2h4':16A 'w48m':15A 'without':56B,120C 'write':43B 'written':86C","nicknames":[],"mitigations":[],"who_affected":"Applications that call deepmerge's mergeObject() with source objects that contain attacker-controlled keys, such as parsed JSON or request bodies, and then read properties from the result without own-property checks. Projects that merge only trusted, server-defined configuration are much less exposed. Projects not using deepmerge 4.2.0 to 4.3.1 can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-09-18T18:18:34+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","cvss_by":"GitHub","poc_count":0,"sources":[{"source":"ghsa","external_id":"GHSA-gcqx-w48m-w2h4","url":"https://github.com/advisories/GHSA-gcqx-w48m-w2h4","severity":"low","published_at":"2026-09-18T18:31:44+00:00","modified_at":"2026-10-27T21:34:58+00:00","first_seen_at":"2026-10-27T21:39:56+00:00","fetched_at":"2026-10-27T23:16:46+00:00","note":null},{"source":"nvd","external_id":"CVE-2026-93753","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-93753","severity":null,"published_at":"2026-09-18T18:18:34+00:00","modified_at":"2026-09-23T17:17:50+00:00","first_seen_at":"2026-10-27T21:59:20+00:00","fetched_at":"2026-10-27T21:59:20+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}