CVE-2026-93753 Details
Description
deepmerge through 4.3.1 contains a prototype poisoning vulnerability in the mergeObject() function that fails to properly validate keys being written to target objects. Attackers can supply malicious source objects in merge operations to inject attacker-controlled properties into the returned object's prototype, causing applications to inherit unintended values when accessing properties without own-property checks.
A prototype poisoning vulnerability has been identified in the deepmerge library, affecting versions 4.2.0 through 4.3.1. The issue arises in the mergeObject() function, which improperly validates keys being written to target objects. This flaw allows attackers to inject properties into the prototype of the object returned by the merge operation, leading to unintended inheritance of values in applications that access these properties without checking for ownership.
Users can update to deepmerge version 4.3.1 or later, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Sep 18, 2026CISA-ADP
Assessed Sep 18, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/TehShrike/deepmerge/issues/273 | CISA-ADP | ExploitIssue TrackingTechnical AnalysisVendor |
| https://github.com/TehShrike/deepmerge | [email protected] | ProductSource CodeVendor |
| https://github.com/TehShrike/deepmerge/blob/5b87756a5671635679001cbac72aa42f23472c81/index.js#L39-L60 | [email protected] | Source CodeVendor |
| https://github.com/TehShrike/deepmerge/issues/273 | [email protected] | ExploitIssue TrackingTechnical AnalysisVendor |
| https://www.vulncheck.com/advisories/deepmerge-through-4.3.1-prototype-poisoning-via-mergeobject | [email protected] | AdvisoryRemedy |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-1321 | Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| TehShrike deepmerge | >= 4.2.0, <= 4.3.1 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 18, 2026 | CVE Modified | CISA-ADP |
| Sep 18, 2026 | New CVE Received | [email protected] |