logo

Database

Authentication mechanism absence or evasion In merge

Description

Prototype Pollution in merge All versions of package merge <2.1.1 are vulnerable to Prototype Pollution via _recursiveMerge .

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem
Component
Affected version
Patched versions

Aliases

1. CVE-2020-284992. NVD-2020-284993. OSV-2020-284994. GCVE-2020-28499

References

1. https://github.com/yeikos/js.merge/commit/7b0ddc2701d813f2ba289b32d6a4b9d4cc235fb42. https://github.com/yeikos/js.merge/blob/56ca75b2dd0f2820f1e08a49f62f04bbfb8c5f8f/src/index.ts#L643. https://github.com/yeikos/js.merge/blob/master/src/index.ts#L64

Does your application use this vulnerable software?

During the free trial, our tools assess your application, identify vulnerabilities, and provide recommendations for their remediation.