CVE-2020-28499

All versions of package merge are vulnerable to Prototype Pollution via _recursiveMerge .

CVE-2021-3645

merge is vulnerable to Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')