CVE-2018-16469
Prototype Pollution in merge
CVE-2018-16469 is a high vulnerability (CVSS 7.5) in Brikcss Merge, published October 30, 2018. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.68%, the 76th percentile. Fixed in merge 1.2.1.
The merge.recursive function in the merge package <1.2.1 can be tricked into adding or modifying properties of the Object prototype. These properties will be present on all objects allowing for a denial of service attack.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
The merge.recursive function in the merge package <1.2.1 can be tricked into adding or modifying properties of the Object prototype. These properties will be present on all objects allowing for a denial of service attack.
- Record
CVE-2018-16469- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - CVSS 2.0
- 5.0 Medium
AV:N/AC:L/Au:N/C:N/I:N/A:P - Weakness
- CWE-400, CWE-20
- Updated
- 2026-11-02
CVE List No score
The merge.recursive function in the merge package <1.2.1 can be tricked into adding or modifying properties of the Object prototype. These properties will be present on all objects allowing for a denial of service attack.
- Record
CVE-2018-16469- Weakness
- CWE-400
- Updated
- 2026-11-02
EUVDEUVD-2018-0749 No score
The merge.recursive function in the merge package <1.2.1 can be tricked into adding or modifying properties of the Object prototype. These properties will be present on all objects allowing for a denial of service attack.
- Record
EUVD-2018-0749- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-f9cm-qmx5-m98h
Prototype Pollution in merge
Versions of merge before 1.2.1 are vulnerable to prototype pollution. The merge.recursive function can be tricked into adding or modifying properties of the Object prototype.
Recommendation
Update to version 1.2.1 or later.
- Record
GHSA-f9cm-qmx5-m98h- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-400, CWE-1321
- Updated
- 2026-11-02
OSV
The merge.recursive function in the merge package <1.2.1 can be tricked into adding or modifying properties of the Object prototype. These properties will be present on all objects allowing for a denial of service attack.
- Record
CVE-2018-16469- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVGHSA-f9cm-qmx5-m98h
Prototype Pollution in merge
Versions of merge before 1.2.1 are vulnerable to prototype pollution. The merge.recursive function can be tricked into adding or modifying properties of the Object prototype.
Recommendation
Update to version 1.2.1 or later.
- Record
GHSA-f9cm-qmx5-m98h- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-1321, CWE-400
- Updated
- 2026-11-02
OSVUBUNTU-CVE-2018-16469
The merge.recursive function in the merge package <1.2.1 can be tricked into adding or modifying properties of the Object prototype. These properties will be present on all objects allowing for a denial of service attack.
- Record
UBUNTU-CVE-2018-16469- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVROOT-APP-NPM-CVE-2018-16469 No score
CVE-2018-16469 in @rootio/merge - Patched by Root
Root has patched CVE-2018-16469 in the @rootio/merge package for Root:npm. Multiple fixed versions available.
- Record
ROOT-APP-NPM-CVE-2018-16469- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
mergenpm |
before 1.2.1 | 1.2.1 |
@rootio/mergeRoot:npm |
before 1.2.1-root.io.1 | 1.2.1-root.io.11.2.1-root.io.2 |
mergeRoot:npm |
before 1.2.1-aikido.2 | 1.2.1-aikido.2 |
node-mergeUbuntu:16.04:LTS |
All versions, plus listed versions 1.2.0-11.2.0-2 |
None known |
node-mergeUbuntu:18.04:LTS |
All versions, plus listed versions 1.2.0-2 |
None known |
node-mergeUbuntu:20.04:LTS |
All versions, plus listed versions 1.2.0-2 |
None known |
node-mergeUbuntu:22.04:LTS |
All versions, plus listed versions 2.1.0+ds-32.1.1+ds-2 |
None known |
History
| When | Changed | Sources |
|---|---|---|
| 2026-11-03 | aliases, products | EUVD |
| 2026-11-02 | created | CVE List, GitHub Advisories, NVD, OSV |