Prototype Pollution in merge

All versions of package merge 2.1.1 are vulnerable to Prototype Pollution via recursiveMerge...

CVE-2020-28499

All versions of package merge are vulnerable to Prototype Pollution via recursiveMerge...

CVE-2020-28499

CVE-2020-28499 affects the Node.js merge package. The vulnerability is a prototype pollution weakness in the _recursiveMerge function that exists in all versions before 2.1.1. Exploitation could allow an attacker to modify object prototypes, potentially leading to arbitrary code execution or mani...