Merge Deep

Submit a proposal Propose CVE/GCVE/GHSA reference

Approved changes feed: RSS · Atom

cpe:2.3:a:merge-deep_project:merge-deep:*:*:*:*:*:node.js:*:*

part: a version: * update: *

VendorMerge Deep Project (7a236a49-9fe4-5df1-99bd-00159b6fdb4a)
ProductMerge Deep (03a8180f-cf55-5769-a46d-60afcd1f6417)
Edition*
Language*
Software edition*
Target softwarenode.js
Target hardware*
Other*

Notes

Imported from purl2cpe mapping

PURL mappings

PURLSourceLast updated
pkg:github/jonschlinkert/merge-deep purl2cpe 2026-06-01 10:11:45.821128
pkg:maven/org.webjars.npm/merge-deep purl2cpe 2026-06-01 10:11:45.821130
pkg:npm/merge-deep purl2cpe 2026-06-01 10:11:45.821132

Vulnerability references

IdentifiercpeApplicabilitySubmitteddb.gcve.eu detailsRationale
CVE:CVE-2021-26707 vulnerable 2026-06-08 05:30:45.124979 Details available
The merge-deep library before 3.0.3 for Node.js can be tricked into overwriting properties of Object.prototype or adding new properties to it. These properties are then inherited by every object in the program, thus facilitating prototype-pollution attacks against applications using this library.
Published: 2021-06-02T14:24:30.000Z
Updated: 2024-08-03T20:33:40.345Z
Reference links
Imported from gcve-enriched-dumps CVE data
CVE:CVE-2018-3722 vulnerable 2026-06-08 05:11:41.172757 Details available
merge-deep node module before 3.0.1 suffers from a Modification of Assumed-Immutable Data (MAID) vulnerability, which allows a malicious user to modify the prototype of "Object" via __proto__, causing the addition or modification of an existing property that will exist on all objects.
Published: 2018-06-07T02:00:00.000Z
Updated: 2024-09-17T04:14:35.263Z
Reference links
Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.

Inspect record JSON

Open JSON directly

Open this panel to browse, search, copy or download the JSON record.