CVE-2022-24802: deepmerge-ts_project deepmerge-ts
CVSS: 9.8v3.1CriticalModified
AliasesGHSA-r9w3-g83q-m6hq
Published 31-03-2022Last modified 23-04-2025
Vulnerability summary
CVE-2022-24802 is a critical (CVSS 9.8) vulnerability in deepmerge-ts_project deepmerge-ts. EPSS estimates a 1.68% chance of exploitation in the next 30 days, higher than 76.6% of scored vulnerabilities.
CVSS score
9.8/10
010
Critical · v3.1 (NVD)EPSS score
1.68%
0%100%
Low · 0.00 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded
Timeline
- 31-03-2022PublishedVulnerability first disclosed.
- 23-04-2025Last modifiedVulnerability information updated.
Description
deepmerge-ts is a typescript library providing functionality to deep merging of javascript objects. deepmerge-ts is vulnerable to Prototype Pollution via file deepmerge.ts, function defaultMergeRecords(). This issue has been patched in version 4.0.2. There are no known workarounds for this issue.
CVSS metrics
4 scores · 3 sources · 2 versionsCritical 9.8Preferred score · NVD (NIST)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HSources3 sources · 8.1–9.8
- CVE.orgCNA8.1HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:HDiffers
- OSV · NpmEcosystem advisory · calculated8.1HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:HDiffers
High 7.5Preferred score · NVD (NIST)
AV:N/AC:L/Au:N/C:P/I:P/A:PSourcesSingle source
EPSS trend
Probability
1.68%
Chance of exploitation in the next 30 days
Percentile
77%
Versus all other CVEs
30-day change
0.00 pp
From 1.68% on 21-09-2026
21-09-202621-10-2026
EPSS score1.68%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-915Improperly Controlled Modification of Dynamically-Determined Object AttributesThe product receives input from an upstream component that specifies multiple attributes, properties, or fields that are to be initialized or updated in an object, but it does not properly control which attributes can be modified.
- CWE-1321Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')The product receives input from an upstream component that specifies attributes that are to be initialized or updated in an object, but it does not properly control modifications of attributes of the object prototype.
Affected systems
Deepmerge-ts_project1 product
- deepmerge-ts< 4.0.2
Npm1 product
- deepmerge-ts< 4.0.2
Rebeccastevens1 product
- deepmerge-ts< 4.0.2
3 vendors · 3 products
References
5 links- github.com/RebeccaStevens/deepmerge-ts/security/advisories/GHSA-r9w3-g83q-m6hqX Refsource CONFIRMWEBThird Party Advisory
- github.com/RebeccaStevens/deepmerge-ts/commit/b39f1a93d9e1c3541bd2fe159fd696a16dbe1c72X Refsource MISCWEBPatchThird Party Advisory
- github.com/RebeccaStevens/deepmerge-ts/commit/d637db7e4fb2bfb113cb4bc1c85a125936d7081bX Refsource MISCWEBPatchThird Party Advisory
