CVE-2021-26707

Name of the Vulnerable Software and Affected Versions merge-deep library versions prior to 3.0.3

Description The issue allows an attacker to trick the library into overwriting properties of Object.prototype or adding new properties to it. These properties are then inherited by every object in the program, facilitating prototype-pollution attacks against applications using this library.

Recommendations For merge-deep library versions prior to 3.0.3, update to version 3.0.3 or later to resolve the issue.