CVE-2026-40345

deepmerge-ts 8.0.0: recursive object graph DoS I reproduced a stack exhaustion bug in deepmerge-ts versions before 8.0.0. The interesting part is that the crash does not need a huge nested object. It comes from object identity. If both values being merged point back to themselves through the same...

Linux Distros Unpatched Vulnerability : CVE-2026-93753

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - deepmerge through 4.3.1 contains a prototype poisoning vulnerability in the mergeObject function that fails to properly validate keys being written to target...

react-cve-2025-55182

CVE-2025-55182: React/Next.js Test Project Status: Experimental / Proof of Concept This repository serves as a controlled research environment and Proof-of-Concept PoC framework for analyzing CVE-2025-55182. It demonstrates a Prototype Pollution vulnerability within the context of Next.js Server...

DEBIAN-CVE-2026-93753

deepmerge through 4.3.1 contains a prototype poisoning vulnerability in the mergeObject function that fails to properly validate keys being written to target objects. Attackers can supply malicious source objects in merge operations to inject attacker-controlled properties into the returned...

CVE-2026-93753

deepmerge through 4.3.1 contains a prototype poisoning vulnerability in the mergeObject function that fails to properly validate keys being written to target objects. Attackers can supply malicious source objects in merge operations to inject attacker-controlled properties into the returned...

CVE-2026-93753

deepmerge through 4.3.1 contains a prototype poisoning vulnerability in the mergeObject function that fails to properly validate keys being written to target objects. Attackers can supply malicious source objects in merge operations to inject attacker-controlled properties into the returned...

CVE-2026-93753 deepmerge through 4.3.1 Prototype Poisoning via mergeObject

deepmerge through 4.3.1 contains a prototype poisoning vulnerability in the mergeObject function that fails to properly validate keys being written to target objects. Attackers can supply malicious source objects in merge operations to inject attacker-controlled properties into the returned...

CVE-2026-93753 deepmerge through 4.3.1 Prototype Poisoning via mergeObject

deepmerge through 4.3.1 contains a prototype poisoning vulnerability in the mergeObject function that fails to properly validate keys being written to target objects. Attackers can supply malicious source objects in merge operations to inject attacker-controlled properties into the returned...

CVE-2026-93753

deepmerge through version 4.3.1 is vulnerable to prototype poisoning in the mergeObject() function, which fails to properly validate keys written to target objects. An attacker can supply malicious source objects in merge operations to inject attacker-controlled properties into the returned objec...

CVE-2026-93753 deepmerge through 4.3.1 Prototype Poisoning via mergeObject

deepmerge through 4.3.1 contains a prototype poisoning vulnerability in the mergeObject function that fails to properly validate keys being written to target objects. Attackers can supply malicious source objects in merge operations to inject attacker-controlled properties into the returned...

EUVD-2026-83258

deepmerge through 4.3.1 contains a prototype poisoning vulnerability in the mergeObject function that fails to properly validate keys being written to target objects. Attackers can supply malicious source objects in merge operations to inject attacker-controlled properties into the returned...

CVE-2026-78180

A security flaw has been discovered in alibaba-fusion next up to 1.27.34. This issue affects the function ConfigProvider.getContextProps of the file components/dialog/index.tsx of the component deepMerge. Performing a manipulation of the argument locale results in improperly controlled modificati...

CVE-2026-78180 alibaba-fusion next deepMerge index.tsx ConfigProvider.getContextProps prototype pollution

A security flaw has been discovered in alibaba-fusion next up to 1.27.34. This issue affects the function ConfigProvider.getContextProps of the file components/dialog/index.tsx of the component deepMerge. Performing a manipulation of the argument locale results in improperly controlled modificati...

CVE-2026-78180 alibaba-fusion next deepMerge index.tsx ConfigProvider.getContextProps prototype pollution

A security flaw has been discovered in alibaba-fusion next up to 1.27.34. This issue affects the function ConfigProvider.getContextProps of the file components/dialog/index.tsx of the component deepMerge. Performing a manipulation of the argument locale results in improperly controlled modificati...

CVE-2026-78180

alibaba-fusion next (up to version 1.27.34) is affected by a prototype pollution vulnerability in the deepMerge component, specifically in the ConfigProvider.getContextProps function within components/dialog/index.tsx. By manipulating the locale argument, an attacker can improperly control object...

EUVD-2026-64702

A security flaw has been discovered in alibaba-fusion next up to 1.27.34. This issue affects the function ConfigProvider.getContextProps of the file components/dialog/index.tsx of the component deepMerge. Performing a manipulation of the argument locale results in improperly controlled modificati...

Prototype Pollution

Overview exceljs is a package to Read, manipulate and write spreadsheet data and styles to XLSX and JSON. Affected versions of this package are vulnerable to Prototype Pollution through Note.model serialization in lib/utils/under-dash.js. An attacker can modify Object.prototype and influence late...

CVE-2026-78207

exceljs through 4.4.0 contains a prototype pollution vulnerability in the deepMerge helper that fails to reject proto, constructor, or prototype keys when merging note objects. Attackers can assign parsed JSON with a malicious proto property to cell notes, modifying Object.prototype and affecting...

CVE-2026-78207

exceljs-hardened before 5.0.0 (also tracked as exceljs through 4.4.0) contains a prototype pollution vulnerability in the deepMerge helper. The helper fails to reject __proto__, constructor, or prototype keys when merging note objects, allowing an attacker to assign parsed JSON with a malicious _...

CVE-2026-78207 exceljs through 4.4.0 Prototype Pollution via deepMerge Reached From Note Serialization

exceljs through 4.4.0 contains a prototype pollution vulnerability in the deepMerge helper that fails to reject proto, constructor, or prototype keys when merging note objects. Attackers can assign parsed JSON with a malicious proto property to cell notes, modifying Object.prototype and affecting...