CVE-2026-93753

About vulnerability

deepmerge through 4.3.1 contains a prototype poisoning vulnerability in the mergeObject() function that fails to properly validate keys being written to target objects. Attackers can supply malicious source objects in merge operations to inject attacker-controlled properties into the returned object’s prototype, causing applications to inherit unintended values when accessing properties without own-property checks.

Affected product:

@expo/build-tools , @ledgerhq/lumen-ui-rnative , @lg-tools/meta , @theme-ui/style-guide , @web3auth/ws-embed , AngularJS , Fastify , React , Vue , analogjs-platform , analogjs-storybook-angular , analogjs-vite-plugin-nitro , apollo-server , apollo-server-fastify , arcjet-js , astro , astrojs-netlify , astrojs-svelte , async-storage , auth , aws-cdk , b4a , babel-plugin-remove-graphql-queries , babel-preset-expo , bare-fs , bare-stream , blake2b , blake2b-wasm , blockchain-link-utils , blocknote-xl-email-exporter , bluelovers/ws-node-novel , browserbasehq-stagehand , browsers , build , chat-adapter-gmail , clerk-clerk-expo , clerk-expo , clerk-expo-biometrics , clerk-expo-google-signin , clerk-expo-native-components , clerk-expo-passkeys , coin-modules , composio-llamaindex , controllers , create-expo-module , create-factory , create-jest , create-react-app , create-sanity , create-yarn-workspaces , customauth , deepgram-sdk , deepmerge , demonovel-cached-data , docusaurus , docusaurus-core , docusaurus-mdx-loader , docusaurus-plugin-content-blog , docusaurus-plugin-content-docs , docusaurus-plugin-content-pages , docusaurus-plugin-debug , docusaurus-plugin-google-analytics , docusaurus-plugin-google-gtag , docusaurus-plugin-google-tag-manager , docusaurus-plugin-sitemap , docusaurus-plugin-svgr , docusaurus-preset-classic , docusaurus-theme-classic , docusaurus-theme-common , docusaurus-theme-mermaid , docusaurus-theme-search-algolia , docusaurus-utils , docusaurus-utils-validation , eas-cli , ecosystem , endo-bundle-source , envelop-graphql-jit , enzyme-matchers , epub-extract , epub-iconv-segment , eslint-plugin-jest , expect-webdriverio , expo , expo-app-integrity , expo-app-intents , expo-app-loading , expo-apple-authentication , expo-application , expo-asset , expo-audio , expo-auth-session , expo-av , expo-background-fetch , expo-background-task , expo-barcode-scanner , expo-battery , expo-blur , expo-branch , expo-brightness , expo-build-properties , expo-calendar , expo-camera , expo-cli , expo-clipboard , expo-config , expo-configure-splash-screen , expo-constants , expo-contacts , expo-crypto , expo-dev-client , expo-dev-client-components , expo-dev-launcher , expo-dev-menu , expo-dev-menu-interface , expo-dev-server , expo-dev-tools , expo-device , expo-document-picker , expo-electron-adapter , expo-error-recovery , expo-expo-cli , expo-file-system , expo-firebase-analytics , expo-firebase-core , expo-firebase-recaptcha , expo-font , expo-gl , expo-glass-effect , expo-google-app-auth , expo-haptics , expo-hinge , expo-image , expo-image-loader , expo-image-picker , expo-insights , expo-intent-launcher , expo-keep-awake , expo-linear-gradient , expo-linking , expo-local-authentication , expo-local-build-cache-provider , expo-localization , expo-location , expo-mail-composer , expo-manifests , expo-maps , expo-media-library , expo-mesh-gradient , expo-metro-config , expo-module-scripts , expo-modules-cli , expo-modules-core , expo-modules-jsi , expo-modules-test-core , expo-navigation-bar , expo-network , expo-network-addons , expo-next-adapter , expo-notifications , expo-permissions , expo-prebuild-config , expo-print , expo-processing , expo-pwa , expo-random , expo-router , expo-router-server , expo-schemer , expo-screen-capture , expo-screen-orientation , expo-secure-store , expo-sensors , expo-sharing , expo-sms , expo-speech , expo-splash-screen , expo-sqlite , expo-standard-web-crypto , expo-status-bar , expo-store-review , expo-symbols , expo-system-ui , expo-task-manager , expo-template-bare-minimum , expo-template-blank , expo-template-blank-typescript , expo-template-default , expo-template-tabs , expo-tracking-transparency , expo-updates , expo-updates-interface , expo-vector-icons , expo-video , expo-video-thumbnails , expo-web-browser , expo-webpack-config , expo-widgets , expo-xdl , expo-yarn-workspaces , fast-json-stringify , fcl-js , fork-ts-checker-webpack-plugin , gatsby , gatsby-interface , gatsby-plugin-compile-es6-packages , gatsby-plugin-fathom , gatsby-plugin-page-creator , gatsby-plugin-react-helmet , gatsby-plugin-sharp , gatsby-sharp , gatsby-source-contentful , gatsby-source-filesystem , gatsby-source-wordpress , gatsby-transformer-sqip , git-lazy-diff-staged , git-lazy-info , git-lazy-root , git-lazy-spawn , git-root2 , globalart-nestjs-zod , gp-js-client , graphql-config , graphql-inspector , graphql-jit , graphql-toolkit , gutenberg , heroui , heroui-image , heroui-theme , hiero-sdk-js , html-to-text , http-helpers , jest , jest-circus , jest-cli , jest-config , jest-core , jest-expo , jest-expo-enzyme , jest-image-snapshot , jest-jasmine2 , jest-preset-angular , jest-repl , jest-reporters , jest-runner , jest-runtime , jest-specific-snapshot , jest-test-sequencer , jest-watch-typeahead , json-render-react-email , kit , langchain-community , lazy-cjk-fullhalf , leafygreen-ui , leafygreen-ui-code , leafygreen-ui-date-picker , leafygreen-ui-select , leafygreen-ui-testing-lib , ledger-cosmos-js , ledgerhq-crypto-icons , ledgerhq-crypto-icons-ui , ledgerhq-live-cli , ledgerhq-live-common , ledgerhq-native-ui , lg-tools-cli , lg-tools-codemods , lg-tools-create , lg-tools-install , lg-tools-link , lg-tools-prompt-kit , lg-tools-slackbot , lg-tools-storybook-addon , lg-tools-storybook-decorators , lg-tools-test , lg-tools-validate , livestore , llamaindexts , loopback , loopback-connector , loopback-connector-remote , loopback-datasource-juggler , loopback-phase , magic-js , masked-view , mastra , mastra-deployer , mastra-deployer-netlify , mastra-deployer-sandbox , mastra-deployer-vercel , mastra-temporal , mastra-voice-deepgram , mastracode , mdx , metadata-helpers , metamask-account-tree-controller , metamask-accounts-controller , metamask-assets-controller , metamask-assets-controllers , metamask-bridge-controller , metamask-bridge-status-controller , metamask-claims-controller , metamask-client-utils , metamask-config-registry-controller , metamask-core , metamask-core-backend , metamask-delegation-controller , metamask-earn-controller , metamask-eip-5792-middleware , metamask-gator-permissions-controller , metamask-money-account-controller , metamask-money-account-upgrade-controller , metamask-multichain-account-service , metamask-multichain-api-middleware , metamask-multichain-network-controller , metamask-multichain-transactions-controller , metamask-network-enablement-controller , metamask-notification-services-controller , metamask-phishing-controller , metamask-profile-controller , metamask-profile-metrics-controller , metamask-profile-sync-controller , metamask-ramps-controller , metamask-seedless-onboarding-controller , metamask-shield-controller , metamask-signature-controller , metamask-smart-transactions-controller , metamask-snap-account-service , metamask-snaps-cli , metamask-snaps-controllers , metamask-snaps-jest , metamask-snaps-simulation , metamask-social-controllers , metamask-subscription-controller , metamask-transaction-controller , metamask-transaction-pay-controller , metamask-user-operation-controller , metamask-wallet , modern-js-adapter-rstest , modern-js-app-tools , modern-js-babel-preset , modern-js-builder , modern-js-plugin-bff , modern-js-server , modern-js-server-utils , modern-js-uni-builder , modern.js , module-federation-core , module-federation-esbuild , mysten-docs , netlify-build , netlify-cms , netlify-cms-app , netlify-cms-core , netlify-dev , netlify-nuxt , netlify-vite-plugin , netlify-vite-plugin-tanstack-start , ng-packagr , nitro , nitroparty , node-archiver , node-novel-layout , node-novel-normalize , node-novel-site-cache-util , node-novel-toc , node-novel-txt-split , novel-epub , novel-text , novel-txt-merge , npm-init2 , npm:@metamask/money-account-utils , npm:@toruslabs/secure-pub-sub , npm:@web3auth/ethereum-provider , npm:gatsby-theme-blog-core , nuxt , nuxt-devtools , nuxt-devtools-kit , nuxt-devtools-ui-kit , nuxt-nitro-server , nuxt-rspack-builder , nuxt-vite-builder , nuxt-vite-server , nuxt-webpack-builder , nx , nx-angular-rspack , nx-detox , nx-eslint , nx-expo , nx-express , nx-jest , nx-module-federation , nx-nest , nx-node , nx-plugin , nx-react , nx-react-native , nx-rollup , nx-vite , nx-vitest , nx-web , nx-webpack , onflow-fcl , onflow-fcl-core , onflow-fcl-rainbowkit-adapter , onflow-fcl-react-native , onflow-fcl-wc , onflow-react-core , onflow-react-sdk , onflow-sdk , open-wc , open-wc-building-rollup , open-wc-building-utils , open-wc-building-webpack , open-wc-demoing-storybook , open-wc-testing-karma , open-wc-testing-karma-bs , openuidev-react-email , orama-orama , patch-project , pkg-utils , plugins , powersync-nuxt , probe-image-size , probot , proload , puppeteer-core , rainbowkit , remirror , remirror/remirror , remix , reown-appkit , reown-appkit-controllers , reown-appkit-scaffold-ui , reown-appkit-ui , reown-appkit-utils , rock , rock-js-platform-apple-helpers , rock-js-platform-ios , rock-js-plugin-brownfield-ios , rock-js-plugin-expo-config-plugins , rollup-plugin-index-html , rollup-plugin-workbox , rsbuild , rsbuild-core , rsbuild-plugin-rem , rsbuild-plugin-stylus , rsbuild-plugin-type-check , rsdoctor-docs , rspack-test-tools , rspress , rushstack-heft-jest-plugin , rushstack-heft-node-rig , rushstack-heft-vscode-extension-rig , rushstack-heft-web-rig , sanitize-html , sanity , sanity-cli , sanity-svelte-loader , sanity-template-validator , sanity-tsdown-config , sanity-vanilla-extract-integration , sanity-vanilla-extract-rolldown-plugin , sanity-vanilla-extract-tsdown-plugin , sanity-vanilla-extract-vite-plugin , sb , scalar-sveltekit , sendgrid-helpers , sendgrid-nodejs , sentry-gatsby , sentry-nuxt , sentry-solidstart , sentry-sveltekit , session-manager-web , shadcn , shadcn-registry , sharp , single-factor-auth , solidjs-start , storybook , storybook-addon-controls , storybook-addon-docs , storybook-addon-essentials , storybook-addon-interactions , storybook-angular , storybook-builder-webpack5 , storybook-cli , storybook-core , storybook-core-common , storybook-core-server , storybook-ember , storybook-html , storybook-html-webpack5 , storybook-nextjs , storybook-preact , storybook-preact-webpack5 , storybook-preset-create-react-app , storybook-react , storybook-react-webpack5 , storybook-server , storybook-server-webpack5 , storybook-svelte , storybook-svelte-vite , storybook-svelte-webpack5 , storybook-sveltekit , storybook-telemetry , storybook-vue3 , storybook-vue3-webpack5 , storybook-web-components , storybook-web-components-webpack5 , str-util , strapi-plugin-cloud , strapi-plugin-color-picker , strapi-plugin-documentation , strapi-plugin-graphql , strapi-plugin-sentry , strapi-plugin-users-permissions , strapi-provider-email-sendgrid , strapi-strapi , streamx , strong-globalize , strong-globalize-cli , strong-remoting , styled-components , sveltejs-adapter-bun , sveltejs-adapter-node , sveltejs-adapter-static , sveltejs-adapter-vercel , sveltejs-kit , sveltejs-vite-plugin-svelte-inspector , svgr , svgr-plugin-prettier , svgr-plugin-svgo , svgr-rollup , swagger-js , swagger-ui , syosetu-api , system-ui/theme-ui , tanstack-ai-vue-ui , tanstack-expo-db-sqlite-persistence , tar-fs , tar-stream , teex , text-decoder , theme-ui , toprf-secure-backup , torus.js , toruslabs-broadcast-channel , toruslabs-fetch-node-details , trezor-connect-web , trezor-env-utils , trezor-suite , ts-jest , ts-sdks , unimodules-task-manager-interface , vanilla-extract , vanilla-extract-recipes , vanilla-extract-sprinkles , vercel , vercel-remix-builder , vinxi , vinxi-router , vinxi-server-components , vinxi-server-functions , visual-editing , vite-plugin-svelte , wallet-adapter , walletconnect-core , walletconnect-sign-client , walletconnect-solana-adapter , walletconnect-types , walletconnect-universal-provider , walletconnect-utils , walletconnect-utils-scoped , wdio-allure-reporter , wdio-appium-service , wdio-browserstack-service , wdio-cli , wdio-concise-reporter , wdio-config , wdio-crossbrowsertesting-service , wdio-cucumber-framework , wdio-devtools-service , wdio-dot-reporter , wdio-firefox-profile-service , wdio-globals , wdio-jasmine-framework , wdio-junit-reporter , wdio-local-runner , wdio-runner , wdio-sauce-service , wdio-shared-store-service , wdio-spec-reporter , wdio-sumologic-reporter , wdio-testingbot-service , wdio-utils , wdio-webdriver-mock-service , web-dev-server , web-dev-server-polyfill , web-dev-server-rollup , web-dev-server-storybook , web-storybook-builder , web-storybook-framework-web-components , web-test-runner , web-test-runner-browserstack , web-test-runner-saucelabs , web-test-runner-webdriver , web3auth , web3auth-web , webdriver , webdriverio , webdriverio-devtools , webpack-assets-manifest , wordpress-abilities , wordpress-admin-ui , wordpress-annotations , wordpress-babel-plugin-makepot , wordpress-block-directory , wordpress-block-editor , wordpress-block-library , wordpress-commands , wordpress-components , wordpress-core-abilities , wordpress-core-commands , wordpress-customize-widgets , wordpress-data , wordpress-data-controls , wordpress-e2e-tests , wordpress-edit-post , wordpress-edit-site , wordpress-edit-widgets , wordpress-global-styles-engine , wordpress-global-styles-ui , wordpress-image-cropper , wordpress-jest-console , wordpress-jest-preset-default , wordpress-keyboard-shortcuts , wordpress-lazy-editor , wordpress-list-reusable-blocks , wordpress-media-fields , wordpress-media-utils , wordpress-notices , wordpress-nux , wordpress-patterns , wordpress-plugins , wordpress-preferences , wordpress-reusable-blocks , wordpress-rich-text , wordpress-scripts , wordpress-server-side-render , wordpress-viewport , wordpress-views , wordpress-widget-dashboard , wordpress-widget-primitives , wordpress-widgets , workbox , ws-git-lazy , ws-glob , ws-regexp , ws-segment , xdl , yarn-tool-fix-all , yarn-tool-pkg-git-info , yarn-tool-pkg-hosted-info , yarn-tool-tag , yarn-tool-ws-changed , zephyr-modernjs-plugin , zephyr-nuxt-module , zmarkdown

Affected packages:

deepmerge @ 4.2.2 (+10692 more)