All the vulnerabilities related to the version 1.1.2 of the package
Prototype Pollution in merge
Versions of merge
before 1.2.1 are vulnerable to prototype pollution. The merge.recursive
function can be tricked into adding or modifying properties of the Object prototype.
Update to version 1.2.1 or later.
Prototype Pollution in merge
All versions of package merge <2.1.1 are vulnerable to Prototype Pollution via _recursiveMerge .