deepmerge vulnerabilities

CVEs whose affected-version data names the deepmerge package. Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.

1 CVERSS

CVE-2026-93753High· 7.5PoC

4d ago

deepmerge through 4.3.1 contains a prototype poisoning vulnerability in the mergeObject() function that fails to properly validate keys being written to target objects

deepmerge through 4.3.1 contains a prototype poisoning vulnerability in the mergeObject() function that fails to properly validate keys being written to target objects. Attackers can supply malicious source objects in merge operations to…

▾ MidnightTehShrike · deepmergeEPSS 0.36%via NVD