Merge Project Merge vulnerabilities

3 vulnerabilities

Known vulnerabilities in Merge Project Merge, newest first, with CVSS severity, EPSS, KEV listings, ransomware use and the affected versions.

7.5CVE-2018-16469ubuntunode-merge+3
EPSS score
1.68%
The merge.recursive function in the merge package <1.2.1 can be tricked into adding or modifying properties of the Object prototype. These properties will be present on all objects allowing for a denial of service attack.9.8CVE-2021-3645merge_projectmerge+2
EPSS score
1.43%
merge is vulnerable to Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')9.8CVE-2020-28499merge_projectmerge+1
EPSS score
1.44%
All versions of package merge are vulnerable to Prototype Pollution via _recursiveMerge .