Lodash.merge is a utility function, part of the popular Lodash library, specifically designed for deeply merging JavaScript objects. Versions 3.2.0 and 3.2.1 offer developers a reliable way to combine the properties of multiple source objects into a single destination object, handling nested objects and arrays effectively. Both versions include a consistent set of dependencies, ensuring compatibility and a stable API for merging objects. These dependencies are internal Lodash modules, crucial for features like array copying, object property iteration, and type checking (array, plain object, typed array, arguments). This meticulous approach guarantees that merge operations are executed with precision and avoid accidental data corruption. However, between version 3.2.0, released on April 16, 2015, and version 3.2.1, released just a couple of weeks later, on May 1, 2015, there is no update about features or bug fixes. The only significant difference spotted relies on the "repository" field in the package.json file. It has changed from "url": "https://github.com/lodash/lodash" to "url": "git+https://github.com/lodash/lodash.git". This suggests a minor adjustment related to the Git repository URL, potentially impacting how developers clone or interface with the Lodash source code. The patch version increment points in the direction of a fix on the repository location. Furthermore, version 3.2.1 includes release date information and the "dist" section is slightly different compared to version 3.2.0. For developers, both versions deliver the core merging functionality, with developers prioritizing dependency consistency and Git repository interactions possibly finding version 3.2.1 more up-to-date, although the core merge functionality remains consistent.
All the vulnerabilities related to the version 3.2.1 of the package
Prototype Pollution in lodash.merge
Versions of lodash.merge
before 4.6.1 are vulnerable to Prototype Pollution. The function 'merge' may allow a malicious user to modify the prototype of Object
via __proto__
causing the addition or modification of an existing property that will exist on all objects.
Update to version 4.6.1 or later.
Prototype Pollution in lodash.merge
Versions of lodash.merge
before 4.6.2 are vulnerable to prototype pollution. The function merge
may allow a malicious user to modify the prototype of Object
via {constructor: {prototype: {...}}}
causing the addition or modification of an existing property that will exist on all objects.
Update to version 4.6.2 or later.