{"id":"GHSA-2m96-9w4j-wgv7","aliases":["CLSA-2026-1773188132","GHSA-h726-x36v-rx45","ROOT-APP-NPM-GHSA-2m96-9w4j-wgv7","ROOT-APP-NPM-GHSA-h726-x36v-rx45"],"status":"published","title":"Prototype Pollution in lodash.merge","description":"Versions of `lodash.merge` before 4.6.1 are vulnerable to Prototype Pollution. The function 'merge' may allow a malicious user to modify the prototype of `Object` via `__proto__` causing the addition or modification of an existing property that will exist on all objects.\n\n\n\n\n## Recommendation\n\nUpdate to version 4.6.1 or later.","facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-1321"],"published":"2020-09-03T18:04:54Z","modified":"2026-11-06T08:15:04Z","fixes":[{"ecosystem":"npm","package":"lodash.merge","fixed_in":["4.6.1","4.6.2"],"sources":["ghsa","osv"]},{"ecosystem":"TuxCare:npm","package":"lodash.merge","fixed_in":["3.3.2-tuxcare.2"],"sources":["osv"]},{"ecosystem":"Root:npm","package":"lodash.merge","fixed_in":["3.3.2-aikido.1"],"sources":["osv"]},{"ecosystem":"Root:npm","package":"@rootio/lodash.merge","fixed_in":["3.3.2-root.io.1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"lodash.merge","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.6.1"}]}]},{"source":"ghsa","ecosystem":"npm","package":"lodash.merge","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.6.2"}]}]},{"source":"osv","ecosystem":"TuxCare:npm","package":"lodash.merge","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.3.2-tuxcare.0"},{"fixed":"3.3.2-tuxcare.2"}]}],"versions":["3.3.2","3.3.2-tuxcare.1"]},{"source":"osv","ecosystem":"npm","package":"lodash.merge","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"4.6.1"}]}]},{"source":"osv","ecosystem":"npm","package":"lodash.merge","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"4.6.2"}]}]},{"source":"osv","ecosystem":"Root:npm","package":"lodash.merge","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.3.2-aikido.1"}]}]},{"source":"osv","ecosystem":"Root:npm","package":"@rootio/lodash.merge","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.3.2-root.io.1"}]}]},{"source":"osv","ecosystem":"Root:npm","package":"lodash.merge","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.3.2-aikido.1"}]}]},{"source":"osv","ecosystem":"Root:npm","package":"@rootio/lodash.merge","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.3.2-root.io.1"}]}]}],"references":[{"url":"https://www.npmjs.com/advisories/1067","tags":["web"]},{"url":"https://github.com/advisories/GHSA-2m96-9w4j-wgv7"},{"url":"https://www.npmjs.com/advisories/1066","tags":["web"]},{"url":"https://github.com/advisories/GHSA-h726-x36v-rx45"}],"sources":{"ghsa":[{"id":"GHSA-2m96-9w4j-wgv7","title":"Prototype Pollution in lodash.merge","description":"Versions of `lodash.merge` before 4.6.1 are vulnerable to Prototype Pollution. The function 'merge' may allow a malicious user to modify the prototype of `Object` via `__proto__` causing the addition or modification of an existing property that will exist on all objects.\n\n\n\n\n## Recommendation\n\nUpdate to version 4.6.1 or later.","status":"published","published":"2020-09-03T18:06:00Z","modified":"2023-01-09T05:03:59Z","cwes":["CWE-1321"],"updated_at":"2026-11-02T14:36:07.581563Z"},{"id":"GHSA-h726-x36v-rx45","title":"Prototype Pollution in lodash.merge","description":"Versions of `lodash.merge` before 4.6.2 are vulnerable to prototype pollution. The function `merge` may allow a malicious user to modify the prototype of `Object` via `{constructor: {prototype: {...}}}` causing the addition or modification of an existing property that will exist on all objects.\n\n\n\n\n## Recommendation\n\nUpdate to version 4.6.2 or later.","status":"published","published":"2020-09-03T18:04:54Z","modified":"2023-01-09T05:04:20Z","cwes":["CWE-1321"],"updated_at":"2026-11-02T14:36:09.554044Z"}],"osv":[{"id":"CLSA-2026-1773188132","title":"TuxCare security update for lodash.merge (2 CVEs)","description":"TuxCare rebuilt lodash.merge to address 2 CVEs. Fixed in 3.3.2-tuxcare.2.","status":"published","published":"2026-08-04T14:52:12Z","modified":"2026-10-15T09:47:28.365563074Z","updated_at":"2026-11-02T15:43:43.249928Z"},{"id":"GHSA-2m96-9w4j-wgv7","title":"Prototype Pollution in lodash.merge","description":"Versions of `lodash.merge` before 4.6.1 are vulnerable to Prototype Pollution. The function 'merge' may allow a malicious user to modify the prototype of `Object` via `__proto__` causing the addition or modification of an existing property that will exist on all objects.\n\n\n\n\n## Recommendation\n\nUpdate to version 4.6.1 or later.","status":"published","published":"2020-09-03T18:06:00Z","modified":"2020-08-31T18:46:06Z","cwes":["CWE-1321"],"updated_at":"2026-11-02T15:46:34.700741Z"},{"id":"GHSA-h726-x36v-rx45","title":"Prototype Pollution in lodash.merge","description":"Versions of `lodash.merge` before 4.6.2 are vulnerable to prototype pollution. The function `merge` may allow a malicious user to modify the prototype of `Object` via `{constructor: {prototype: {...}}}` causing the addition or modification of an existing property that will exist on all objects.\n\n\n\n\n## Recommendation\n\nUpdate to version 4.6.2 or later.","status":"published","published":"2020-09-03T18:04:54Z","modified":"2020-08-31T18:46:04Z","cwes":["CWE-1321"],"updated_at":"2026-11-02T15:46:48.920784Z"},{"id":"ROOT-APP-NPM-GHSA-2m96-9w4j-wgv7","title":"GHSA-2m96-9w4j-wgv7 in lodash.merge - Patched by Root","description":"Root has patched GHSA-2m96-9w4j-wgv7 in the lodash.merge package for Root:npm. Multiple fixed versions available.","status":"published","published":"2026-11-06T07:54:29Z","modified":"2026-11-06T08:15:04.477204621Z","updated_at":"2026-11-06T08:36:29.497632Z"},{"id":"ROOT-APP-NPM-GHSA-h726-x36v-rx45","title":"GHSA-h726-x36v-rx45 in lodash.merge - Patched by Root","description":"Root has patched GHSA-h726-x36v-rx45 in the lodash.merge package for Root:npm. Multiple fixed versions available.","status":"published","published":"2026-11-06T07:54:29Z","modified":"2026-11-06T08:15:03.300209053Z","updated_at":"2026-11-06T08:36:29.497632Z"}]}}