Prototype pollution in @feathersjs/commons _.merge via JSON-parsed __proto__

Impact The .mergetarget, source utility exported by @feathersjs/commons recursively merges source into target by iterating Object.keyssource. When source was produced by JSON.parse and contains a proto or constructor / prototype key, that key is returned as an own-enumerable property. The recursi...

@magickml/agent-server (>=0.0.1, <=0.1.8-0), @magickml/agents (>=0.0.10-0, <=0.0.13-7) +31 more potentially affected by CVE-2026-54335 via @feathersjs/commons (>=5.0.0, <=5.0.42)

@feathersjs/commons NPM version =5.0.0, =0.0.1, =0.0.10-0, =0.0.10-0, =0.0.1, =1.0.24, =0.0.40, =0.1.14, =0.0.42, =0.0.68, =0.0.1, =0.0.35, =0.0.35, =1.0.32, =0.1.8, =0.0.29, =0.0.32 and more Source cves: CVE-2026-54335 Source advisory: OSV:GHSA-28XV-PH75-77WH...

PT-2026-60100

Name of the Vulnerable Software and Affected Versions @feathersjs/commons versions prior to 5.0.45 Description The .mergetarget, source utility recursively merges a source object into a target object by iterating through Object.keyssource. If the source object is generated via JSON.parse and...