Skip to content

Vendor

merge-object project vulnerabilities

1 published CVE affecting merge-object project, from public sources (CVE.org, NVD, CISA KEV, FIRST EPSS, OSV).

Total
1
Critical
1
High
0
Medium
0
Low
0
Unscored
0
CISA KEV
0
Atom feed of merge-object project alerts

Products

Latest merge-object project CVEs

Newest publication first

  1. CVE-2018-3753 Prototype Pollution in async merge-object

    Published
    CriticalCVSS 9.8 EPSS 1.4%

    The utilities function in all versions <= 1.0.0 of the merge-objects node module can be tricked into modifying the prototype of Object when the attacker can control part of the structure passed to this function. This can let an attacker add or modify existing properties that will...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.