CVE-2021-3645

merge is vulnerable to Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')