CVE-2026-93753 in deepmerge
Summary
by MITRE • 09/18/2026
deepmerge through 4.3.1 contains a prototype poisoning vulnerability in the mergeObject() function that fails to properly validate keys being written to target objects. Attackers can supply malicious source objects in merge operations to inject attacker-controlled properties into the returned object's prototype, causing applications to inherit unintended values when accessing properties without own-property checks.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 09/18/2026
The vulnerability identified in deepmerge versions through 4.3.1 constitutes a significant security risk classified as Prototype Pollution, which aligns with CWE-1321 within the Common Weakness Enumeration framework. This flaw resides specifically within the mergeObject function of the library's core logic. The fundamental technical issue stems from an insufficient validation mechanism when processing keys during object merging operations. When deepmerge combines a source object into a target object, it iterates through the properties of the source and assigns them to the target. However, in vulnerable versions, this process does not adequately check if the property key being written is a special prototype-influencing attribute such as _proto_, constructor, or prototype itself. Consequently, an attacker can craft a malicious input payload containing these specific keys within a nested object structure.
When this malicious source object is passed to the merge function, the library blindly assigns the provided values to the target's internal [[Prototype]] chain rather than treating them as standard data properties. This behavior allows for the injection of arbitrary properties into Object.prototype or other inherited prototypes in the JavaScript execution environment. Because JavaScript objects inherit from their prototype chains by default, this pollution affects all subsequent object instantiations within the same runtime context that do not explicitly use own property checks like hasOwnProperty to filter out inherited attributes. The lack of validation on keys represents a critical failure in input sanitization, allowing untrusted data to alter the fundamental behavior of core language constructs.
The operational impact of this vulnerability is severe and can lead to various downstream security issues depending on how the affected application utilizes deepmerge. In web applications using Node.js or browser-based JavaScript environments, prototype pollution can be leveraged for Denial of Service attacks by modifying critical methods like toString or valueOf, causing crashes when these methods are invoked unexpectedly. More critically, it serves as a precursor to Remote Code Execution in certain contexts where serialized data is processed and the polluted properties influence security-sensitive logic paths. For instance, if an application relies on checking specific configuration flags that have been overwritten via prototype pollution, access control mechanisms may be bypassed or administrative functions might become accessible to unauthorized users. The persistence of these changes across multiple requests makes this a persistent threat vector rather than a transient error.
To mitigate this vulnerability, organizations must immediately upgrade deepmerge to version 4.3.2 or later, where the mergeObject function has been patched to explicitly check for and ignore prototype-influencing keys unless specifically intended by design with safe defaults enabled. For applications unable to update immediately due to dependency constraints, a temporary workaround involves implementing a custom merging strategy that validates all property keys before assignment, ensuring that _proto_, constructor, and prototype are excluded from the merge operation. Additionally, developers should audit codebases for any usage of deepmerge on untrusted user input and consider using alternative libraries with more rigorous security defaults or manually sanitizing inputs prior to passing them to the library. Regular dependency audits using tools like npm audit or Snyk can help identify instances of this vulnerable version in production environments.
From a threat intelligence perspective, this vulnerability maps to MITRE ATT&CK technique T1559, specifically Inter-Process Communication via Object Injection, as it involves manipulating shared state through object properties. It also relates to CWE-20 Improper Input Validation and CWE-78 Improper Neutralization of Special Elements used in an OS Command if the pollution leads to command execution scenarios. Security teams should monitor for exploitation attempts that involve sending JSON payloads with nested _proto_ or constructor keys, particularly in APIs that accept complex object structures for merging or configuration purposes. Maintaining strict input validation policies and keeping third-party dependencies up to date are essential practices to prevent such prototype-based attacks from succeeding in modern web applications.