CVE-2026-3030-Prototype-Pollution-in-JSON-Merge-Patch

CVE-2026-3030 – Prototype Pollution in JSON Merge Patch Program Code Node.js root@kitploit: // server.js - Vulnerable REST API with deep merge const express = require'express'; const app = express; app.useexpress.json; let config = role: 'user', settings: ; // Insecure deep merge function...

Paul Humphreys patchmerge 安全漏洞

Paul Humphreys patchmerge is Paul Humphreys an open source application . Provides an implementation of JSON Merge Patch RFC 7396 with extensions to support merging arrays of objects . A security vulnerability exists in patchmerge versions 1.0.0 through 1.0.1 that can be exploited by an attacker t...

Prototype Pollution in pierreinglebert/json-merge-patch

Description json-merge-patch is vulnerable to Prototype Pollution. This package fails to restrict access to prototypes of objects, allowing for modification of prototype behavior using a proto payload, which may result in Information Disclosure/DoS/RCE. Proof of Concept 1. Create the following Po...

Node.js third-party modules: [json8-merge-patch] Prototype Pollution

I would like to report a Prototype Pollution vulnerability in json8-merge-patch The apply function fails to restrict access to prototypes of objects, allowing for modification of prototype behavior. Module module name: json8-merge-patch version: v1.0.1 npm page:...