CVE-2026-93753
Description
A flaw was found in deepmerge. This vulnerability, known as prototype poisoning, allows an attacker to inject malicious properties into an application's object prototype. This occurs in the mergeObject() function due to insufficient validation of keys during object merging. By supplying specially crafted input, an attacker can cause applications to inherit unintended values, which may lead to arbitrary code execution or other impacts.
Statement
A prototype poisoning vulnerability was discovered in the deepmerge library within the mergeObject() function. By supplying a maliciously crafted object containing prototype-modifying keys (such as proto or constructor.prototype) to merge operations, an attacker can inject arbitrary properties directly into the application's global object prototype. In Red Hat environments executing Node.js runtimes, this allows untrusted input to alter runtime object states and cause applications to inherit unintended values, potentially resulting in altered application behavior, denial of service, or unauthorized state modification.
Mitigation
Sanitize incoming untrusted JSON objects to strip prototype-polluting keys such as __proto__ and constructor prior to merging, or execute Object.freeze(Object.prototype) at application startup to prevent runtime modifications.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 7.5 | N/A | 7.5 |
| Attack Vector | Network | N/A | Network |
| Attack Complexity | Low | N/A | Low |
| Privileges Required | None | N/A | None |
| User Interaction | None | N/A | None |
| Scope | Unchanged | N/A | Unchanged |
| Confidentiality | None | N/A | None |
| Integrity Impact | High | N/A | High |
| Availability Impact | None | N/A | None |
Vector
Red Hat: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
cve.org: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
