CVE-2026-93753

A flaw was found in deepmerge. This vulnerability, known as prototype poisoning, allows an attacker to inject malicious properties into an application's object prototype. This occurs in the mergeObject() function due to insufficient validation of keys during object merging. By supplying specially crafted input, an attacker can cause applications to inherit unintended values, which may lead to arbitrary code execution or other impacts.

A prototype poisoning vulnerability was discovered in the deepmerge library within the mergeObject() function. By supplying a maliciously crafted object containing prototype-modifying keys (such as proto or constructor.prototype) to merge operations, an attacker can inject arbitrary properties directly into the application's global object prototype. In Red Hat environments executing Node.js runtimes, this allows untrusted input to alter runtime object states and cause applications to inherit unintended values, potentially resulting in altered application behavior, denial of service, or unauthorized state modification.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Sanitize incoming untrusted JSON objects to strip prototype-polluting keys such as proto and constructor prior to merging, or execute Object.freeze(Object.prototype) at application startup to prevent runtime modifications.