7.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

GHSA-mhwj-73qx-jqxm

GHSA-mhwj-73qx-jqxm: @theecryptochad/merge-guard has Prototype Pollution in its deepMerge() function

Summary

@theecryptochad/merge-guard versions prior to 1.0.1 are vulnerable to Prototype Pollution via the deepMerge() function. An attacker who controls the source object can inject __proto__ keys that mutate Object.prototype, affecting all objects in the Node.js runtime.

Details

The deepMerge() function recursively merges two objects without sanitizing reserved property keys (__proto__, constructor, prototype). When a source object contains a __proto__ key, its value is assigned to target.__proto__, which JavaScript engines interpret as a write to Object.prototype.

Proof of Concept

const { deepMerge } = require('@theecryptochad/merge-guard');
const payload = JSON.parse('{"__proto__":{"isAdmin":true}}');
deepMerge({}, payload);
console.log({}.isAdmin); // true — Object.prototype is polluted

Impact

Any application using deepMerge() with untrusted input (e.g. user-supplied JSON from HTTP requests, WebSocket messages, or config files) is vulnerable. An attacker can inject arbitrary properties onto Object.prototype, enabling privilege escalation, application logic bypass, and property injection.

Remediation

Upgrade to @theecryptochad/merge-guard >= 1.0.1, which adds an explicit blocklist:

const BLOCKED = new Set(['__proto__', 'constructor', 'prototype']);
if (BLOCKED.has(key)) continue;

References

(GitHub Advisory)

Miggo Vulnerability Database

→

GHSA-mhwj-73qx-jqxm

GHSA-mhwj-73qx-jqxm:

7.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
@theecryptochad/merge-guard	npm	< 1.0.1	1.0.1

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a classic case of prototype pollution located in the deepMerge function of the @theecryptochad/merge-guard package. The function's purpose is to recursively merge two JavaScript objects. The flaw existed because the function did not validate or sanitize the keys of the source object before merging them into the target object. This allowed an attacker to submit a payload containing a __proto__ key, which the JavaScript engine interprets as a directive to modify the global Object.prototype. By polluting the prototype, an attacker could inject arbitrary properties into all objects within the Node.js runtime, leading to serious security consequences such as privilege escalation or application logic bypasses. The provided commit patch clearly shows the addition of a blocklist for __proto__, constructor, and prototype keys within the deepMerge function, which directly addresses and confirms the location of the vulnerability.

Vulnerable functions

deepMerge

index.js

The `deepMerge` function is vulnerable to prototype pollution. It recursively merges a `source` object into a `target` object. Prior to the patch, the function did not check for malicious keys like `__proto__`, `constructor`, or `prototype` in the `source` object. An attacker could provide a specially crafted `source` object (e.g., `JSON.parse('{\"__proto__\":{\"isAdmin\":true}}')`) to modify the `Object.prototype`. This would pollute the prototype of all objects in the application, potentially leading to privilege escalation, denial of service, or other security vulnerabilities. The patch introduces a blocklist to prevent these keys from being processed.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.

7.5

-

Basic Information

Basic Information

Concerned about an active attack path?

GHSA-mhwj-73qx-jqxm: @theecryptochad/merge-guard has Prototype Pollution in its deepMerge() function

Summary

Details

Proof of Concept

Impact

Remediation

References

GHSA-mhwj-73qx-jqxm:

7.5

-

Basic Information

Basic Information

Is this CVE running in your environment?

Technical Details

Technical Details

Vulnerability IntelligenceMiggo AI

Root Cause Analysis

Vulnerable functions

Vulnerability IntelligenceMiggo AI

Unlock WAF rules for this CVE

WAF Protection Rules

WAF Rule

Reasoning

Basic Information

Basic Information

Technical Details

GHSA-mhwj-73qx-jqxm: @theecryptochad/merge-guard has Prototype Pollution in its deepMerge() function

Summary

Details

Proof of Concept

Impact

Remediation

References

7.5

7.5

Vulnerability IntelligenceMiggo AI

Root Cause Analysis

Vulnerable functions

Vulnerability Intelligence
Miggo AI

Vulnerability Intelligence
Miggo AI

Vulnerability Intelligence
Miggo AI