CVE-2026-54335

Name of the Vulnerable Software and Affected Versions @feathersjs/commons versions prior to 5.0.45

Description The .merge(target, source) utility recursively merges a source object into a target object by iterating through Object.keys(source). If the source object is generated via JSON.parse and contains proto, constructor, or prototype keys, the merge process can resolve target[' proto '] to Object.prototype. This allows an attacker to write arbitrary properties onto Object.prototype, resulting in prototype pollution for all plain objects within the Node process for its entire lifetime. Exploitation requires a downstream plugin or application to pass JSON-parsed, attacker-controlled input directly through the exported .merge function.

Recommendations Update to version 5.0.45. Avoid passing JSON-parsed untrusted input through the .merge() function. Freeze Object.prototype or validate and sanitize keys upstream.