GHSA-2m96-9w4j-wgv7
Prototype Pollution in lodash.merge
GHSA-2m96-9w4j-wgv7 is a vulnerability with no CVSS score yet in lodash.merge, published September 3, 2020. No source lists public exploit code. Fixed in lodash.merge 4.6.1.
- Severity
- UnratedNo CVSS score yet
- Exploit chance
- UnscoredNo EPSS score yet
- Exploitation
- None knownNot on CISA’s or ENISA’s lists
- Fixed in
4.6.1lodash.merge +4 more
Description
Versions of lodash.merge before 4.6.1 are vulnerable to Prototype Pollution. The function 'merge' may allow a malicious user to modify the prototype of Object via __proto__ causing the addition or modification of an existing property that will exist on all objects.
Recommendation
Update to version 4.6.1 or later.
Affected packages
| Package | Affected | Fixed |
|---|---|---|
lodash.mergenpm | before 4.6.1 | 4.6.1 |
lodash.mergenpm | before 4.6.2 | 4.6.2 |
lodash.mergeTuxCare:npm | 3.3.2-tuxcare.0 up to 3.3.2-tuxcare.2, plus listed versions 3.3.23.3.2-tuxcare.1 | 3.3.2-tuxcare.2 |
lodash.mergeRoot:npm | before 3.3.2-aikido.1 | 3.3.2-aikido.1 |
@rootio/lodash.mergeRoot:npm | before 3.3.2-root.io.1 | 3.3.2-root.io.1 |
What each source reports
GitHub AdvisoriesNo score
Prototype Pollution in lodash.merge
Versions of lodash.merge before 4.6.1 are vulnerable to Prototype Pollution. The function 'merge' may allow a malicious user to modify the prototype of Object via __proto__ causing the addition or modification of an existing property that will exist on all objects.
Recommendation
Update to version 4.6.1 or later.
- Record
GHSA-2m96-9w4j-wgv7- Weakness
- CWE-1321
- Updated
- 2026-11-02
GitHub AdvisoriesGHSA-h726-x36v-rx45No score
Prototype Pollution in lodash.merge
Versions of lodash.merge before 4.6.2 are vulnerable to prototype pollution. The function merge may allow a malicious user to modify the prototype of Object via {constructor: {prototype: {...}}} causing the addition or modification of an existing property that will exist on all objects.
Recommendation
Update to version 4.6.2 or later.
- Record
GHSA-h726-x36v-rx45- Weakness
- CWE-1321
- Updated
- 2026-11-02
OSVCLSA-2026-1773188132No score
TuxCare security update for lodash.merge (2 CVEs)
TuxCare rebuilt lodash.merge to address 2 CVEs. Fixed in 3.3.2-tuxcare.2.
- Record
CLSA-2026-1773188132- Updated
- 2026-11-02
OSVNo score
Prototype Pollution in lodash.merge
Versions of lodash.merge before 4.6.1 are vulnerable to Prototype Pollution. The function 'merge' may allow a malicious user to modify the prototype of Object via __proto__ causing the addition or modification of an existing property that will exist on all objects.
Recommendation
Update to version 4.6.1 or later.
- Record
GHSA-2m96-9w4j-wgv7- Weakness
- CWE-1321
- Updated
- 2026-11-02
OSVGHSA-h726-x36v-rx45No score
Prototype Pollution in lodash.merge
Versions of lodash.merge before 4.6.2 are vulnerable to prototype pollution. The function merge may allow a malicious user to modify the prototype of Object via {constructor: {prototype: {...}}} causing the addition or modification of an existing property that will exist on all objects.
Recommendation
Update to version 4.6.2 or later.
- Record
GHSA-h726-x36v-rx45- Weakness
- CWE-1321
- Updated
- 2026-11-02
OSVROOT-APP-NPM-GHSA-2m96-9w4j-wgv7No score
GHSA-2m96-9w4j-wgv7 in lodash.merge - Patched by Root
Root has patched GHSA-2m96-9w4j-wgv7 in the lodash.merge package for Root:npm. Multiple fixed versions available.
- Record
ROOT-APP-NPM-GHSA-2m96-9w4j-wgv7- Updated
- 2026-11-06
OSVROOT-APP-NPM-GHSA-h726-x36v-rx45No score
GHSA-h726-x36v-rx45 in lodash.merge - Patched by Root
Root has patched GHSA-h726-x36v-rx45 in the lodash.merge package for Root:npm. Multiple fixed versions available.
- Record
ROOT-APP-NPM-GHSA-h726-x36v-rx45- Updated
- 2026-11-06
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, aliases, facts | OSV | |
| first indexed | GitHub Advisories, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.