GHSA-992f-wf4w-x36v
Prototype Pollution in merge-objects
All versions of merge-objects are vulnerable to Prototype Pollution.
Recommendation
No fix is available for this vulnerability at this time. It is our recommendation to use an alternative package.
What each source reports
GitHub AdvisoriesNo score
Prototype Pollution in merge-objects
All versions of merge-objects are vulnerable to Prototype Pollution.
Recommendation
No fix is available for this vulnerability at this time. It is our recommendation to use an alternative package.
- Record
GHSA-992f-wf4w-x36v- Weakness
- CWE-1321
- Updated
- 2026-11-02
OSVNo score
Prototype Pollution in merge-objects
All versions of merge-objects are vulnerable to Prototype Pollution.
Recommendation
No fix is available for this vulnerability at this time. It is our recommendation to use an alternative package.
- Record
GHSA-992f-wf4w-x36v- Weakness
- CWE-1321
- Updated
- 2026-11-02
Affected packages
| Package | Affected | Fixed |
|---|---|---|
merge-objectsnpm | 0.0.0 and later | None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | GitHub Advisories, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
GHSA-992f-wf4w-x36v is a vulnerability with no CVSS score yet in merge-objects, published September 1, 2020. No source lists public exploit code. No source names a fixed version.