Security Advisory: Prototype Pollution via mergeObject() (CVE-2026-93753 / GHSA-gcqx-w48m-w2h4) #285

Summary

A high-severity Prototype Pollution vulnerability (CVE-2026-93753 / GHSA-gcqx-w48m-w2h4) has been published affecting deepmerge through version 4.3.1.

Vulnerability Details

• CWE: CWE-1321 (Improperly Controlled Modification of Object Prototype Attributes)
• Severity: High (CVSS v4.0: 8.7)
• Affected Function: mergeObject()
• Description: The function does not properly validate or sanitize object keys (such as __proto__, constructor, or prototype) during merge operations, allowing malicious input to pollute Object.prototype.

References

• GitHub Advisory: GHSA-gcqx-w48m-w2h4
• NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2026-93753

Thank you for your maintainership!