[pkg-vuln] CVE-2026-93753 in deepmerge@4.3.1 #1383

New Issue

kert · 2026-10-28T06:02:00Z

kert commented

2026-10-28 06:02:00 +00:00

Severity: LOW
Package: deepmerge @ 4.3.1
Fixed in: none

deepmerge through 4.3.1 contains a prototype poisoning vulnerability in the mergeObject() function that fails to properly validate keys being written to target objects. Attackers can supply malicious source objects in merge operations to inject attacker-controlled properties into the returned object's prototype, causing applications to inherit unintended values when accessing properties without own-property checks.

Reference: https://nvd.nist.gov/vuln/detail/CVE-2026-93753

**Severity:** LOW **Package:** `deepmerge` @ `4.3.1` **Fixed in:** `none` deepmerge through 4.3.1 contains a prototype poisoning vulnerability in the mergeObject() function that fails to properly validate keys being written to target objects. Attackers can supply malicious source objects in merge operations to inject attacker-controlled properties into the returned object's prototype, causing applications to inherit unintended values when accessing properties without own-property checks. **Reference:** https://nvd.nist.gov/vuln/detail/CVE-2026-93753

kert added this to the P21: Package Supply Chain — inventory, mirrors, drift, vuln scanning milestone 2026-10-28 06:02:00 +00:00

kert added the ci quality labels 2026-10-28 06:02:00 +00:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: homelab/stack#1383