CVE-2026-25639: Improper Check for Unusual or Exceptional Conditions

Axios is a promise based HTTP client for the browser and Node.js. Prior to versions 0.30.3 and 1.13.5, the mergeConfig function in axios crashes with a TypeError when processing configuration objects containing proto as an own property. An attacker can trigger this by providing a malicious...

Prototype Pollution

vega is vulnerable to prototype pollution. The vulnerability exists due to a lack of validation of the properties of the Object.prototype in the 'vega.mergeConfig' function, allowing an attacker to manipulate the objects...

Prototype Pollution

Overview vega-util is a JavaScript utilities package for Vega. Affected versions of this package are vulnerable to Prototype Pollution. The vega.mergeConfig method within vega-util could be tricked into adding or modifying properties of Object.prototype. PoC by Snyk var util = require'vega-util'...