CVE-2026-40345

deepmerge-ts mergeleft.self, right.self - mergeleft.self, right.self - mergeleft.self, right.self - RangeError: Maximum call stack size exceeded 동일한 동작은 deepmergeInto, deepmergeCustom, deepmergeIntoCustom이 같은 종류의 그래프를 입력으로 받을 때도 발생할 수 있습니다. 로컬 재현 패키지는 package.json에서 영향을 받는 7.1.6 릴리스로 고정되어 있습니다. n...

react-cve-2025-55182

CVE-2025-55182: React/Next.js 테스트 프로젝트 상태: 실험적 / 개념 증명 이 저장소는 CVE-2025-55182 를 분석하기 위한 통제된 연구 환경이자 개념 증명PoC 프레임워크 역할을 합니다. Next.js Server Actions 맥락에서 프로토타입 오염Prototype Pollution 취약점을 시연하며, 특히 안전하지 않은 재귀 병합 작업을 대상으로 합니다. 개요 핵심 취약점은 Next.js Server ActionsyncConfiguration 내에 구현된 사용자 정의 deepMerge 유틸...

CLSA-2026-1790609747 TuxCare security update for deepmerge-ts (1 CVE)

TuxCare rebuilt deepmerge-ts to address 1 CVE. Fixed in 7.1.6-tuxcare.1...

CLSA-2026-1790420043 TuxCare security update for deepmerge-ts (1 CVE)

TuxCare rebuilt deepmerge-ts to address 1 CVE. Fixed in 4.3.0-tuxcare.1...

Linux Distros Unpatched Vulnerability : CVE-2026-93753

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - deepmerge through 4.3.1 contains a prototype poisoning vulnerability in the mergeObject function that fails to properly validate keys being written to target...

CVE-2026-93753

deepmerge through 4.3.1 contains a prototype poisoning vulnerability in the mergeObject function that fails to properly validate keys being written to target objects. Attackers can supply malicious source objects in merge operations to inject attacker-controlled properties into the returned...

DEBIAN-CVE-2026-93753

deepmerge through 4.3.1 contains a prototype poisoning vulnerability in the mergeObject function that fails to properly validate keys being written to target objects. Attackers can supply malicious source objects in merge operations to inject attacker-controlled properties into the returned...

CVE-2026-93753

deepmerge through 4.3.1 contains a prototype poisoning vulnerability in the mergeObject function that fails to properly validate keys being written to target objects. Attackers can supply malicious source objects in merge operations to inject attacker-controlled properties into the returned...

UBUNTU-CVE-2026-93753

deepmerge through 4.3.1 contains a prototype poisoning vulnerability in the mergeObject function that fails to properly validate keys being written to target objects. Attackers can supply malicious source objects in merge operations to inject attacker-controlled properties into the returned...

CVE-2026-93753

deepmerge through 4.3.1 contains a prototype poisoning vulnerability in the mergeObject function that fails to properly validate keys being written to target objects. Attackers can supply malicious source objects in merge operations to inject attacker-controlled properties into the returned...

CVE-2026-93753

deepmerge through version 4.3.1 is vulnerable to prototype poisoning in the mergeObject() function, which fails to properly validate keys written to target objects. An attacker can supply malicious source objects in merge operations to inject attacker-controlled properties into the returned objec...

CVE-2026-93753 deepmerge through 4.3.1 Prototype Poisoning via mergeObject

deepmerge through 4.3.1 contains a prototype poisoning vulnerability in the mergeObject function that fails to properly validate keys being written to target objects. Attackers can supply malicious source objects in merge operations to inject attacker-controlled properties into the returned...

CVE-2026-93753 deepmerge through 4.3.1 Prototype Poisoning via mergeObject

deepmerge through 4.3.1 contains a prototype poisoning vulnerability in the mergeObject function that fails to properly validate keys being written to target objects. Attackers can supply malicious source objects in merge operations to inject attacker-controlled properties into the returned...

CVE-2026-93753 deepmerge through 4.3.1 Prototype Poisoning via mergeObject

deepmerge through 4.3.1 contains a prototype poisoning vulnerability in the mergeObject function that fails to properly validate keys being written to target objects. Attackers can supply malicious source objects in merge operations to inject attacker-controlled properties into the returned...

EUVD-2026-83258

deepmerge through 4.3.1 contains a prototype poisoning vulnerability in the mergeObject function that fails to properly validate keys being written to target objects. Attackers can supply malicious source objects in merge operations to inject attacker-controlled properties into the returned...

CVE-2026-93753: Improperly Controlled Modification of Object Prototype Attributes

deepmerge through 4.3.1 contains a prototype poisoning vulnerability in the mergeObject function that fails to properly validate keys being written to target objects. Attackers can supply malicious source objects in merge operations to inject attacker-controlled properties into the returned...

CVE-2026-78180

A security flaw has been discovered in alibaba-fusion next up to 1.27.34. This issue affects the function ConfigProvider.getContextProps of the file components/dialog/index.tsx of the component deepMerge. Performing a manipulation of the argument locale results in improperly controlled modificati...

CVE-2026-78180 alibaba-fusion next deepMerge index.tsx ConfigProvider.getContextProps prototype pollution

A security flaw has been discovered in alibaba-fusion next up to 1.27.34. This issue affects the function ConfigProvider.getContextProps of the file components/dialog/index.tsx of the component deepMerge. Performing a manipulation of the argument locale results in improperly controlled modificati...

CVE-2026-78180 alibaba-fusion next deepMerge index.tsx ConfigProvider.getContextProps prototype pollution

A security flaw has been discovered in alibaba-fusion next up to 1.27.34. This issue affects the function ConfigProvider.getContextProps of the file components/dialog/index.tsx of the component deepMerge. Performing a manipulation of the argument locale results in improperly controlled modificati...

CVE-2026-78180 alibaba-fusion next deepMerge index.tsx ConfigProvider.getContextProps prototype pollution

A security flaw has been discovered in alibaba-fusion next up to 1.27.34. This issue affects the function ConfigProvider.getContextProps of the file components/dialog/index.tsx of the component deepMerge. Performing a manipulation of the argument locale results in improperly controlled modificati...