CVE-2021-26707

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

The merge-deep library before 3.0.3 for Node.js can be tricked into overwriting properties of Object.prototype or adding new properties to it. These properties are then inherited by every object in the program, thus facilitating prototype-pollution attacks against applications using this library.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-1321

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://github.com/jonschlinkert/merge-deep/commit/11e5dd56de8a6aed0b1ed022089dbce6968d82a5Patch, Third Party Advisory
https://security.netapp.com/advisory/ntap-20210716-0008/Third Party Advisory
https://securitylab.github.com/advisories/GHSL-2020-160-merge-deep/Third Party Advisory
https://www.npmjs.com/package/merge-deepProduct, Third Party Advisory
https://github.com/jonschlinkert/merge-deep/commit/11e5dd56de8a6aed0b1ed022089dbce6968d82a5Patch, Third Party Advisory
https://security.netapp.com/advisory/ntap-20210716-0008/Third Party Advisory
https://securitylab.github.com/advisories/GHSL-2020-160-merge-deep/Third Party Advisory
https://www.npmjs.com/package/merge-deepProduct, Third Party Advisory

Timeline

Published: Jun 2, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-267087.0A local privilege escalation was discovered in the Linux kernel before 5.10.13. Multiple race conditions in the AF_VSOCK implementation are CVE-2021-267099.8D-Link DSL-320B-D1 devices through EU_1.25 are prone to multiple Stack-Based Buffer Overflows that allow unauthenticated remote attackers to CVE-2021-267106.1A cross-site scripting (XSS) issue in the login panel in Redwood Report2Web 4.3.4.5 and 4.5.3 allows remote attackers to inject JavaScript v CVE-2021-267115.3A frame-injection issue in the online help in Redwood Report2Web 4.3.4.5 allows remote attackers to render an external resource inside a fra CVE-2021-267127.5Incorrect access controls in res_srtp.c in Sangoma Asterisk 13.38.1, 16.16.0, 17.9.1, and 18.2.0 and Certified Asterisk 16.8-cert5 allow a r CVE-2021-267136.5A stack-based buffer overflow in res_rtp_asterisk.c in Sangoma Asterisk before 16.16.1, 17.x before 17.9.2, and 18.x before 18.2.1 and Certi CVE-2021-267149.8The Enterprise License Manager portal in Mitel MiContact Center Enterprise before 9.4 could allow a user to access restricted files and fold CVE-2021-267159.1The OpenID Connect server implementation for MITREid Connect through 1.3.3 contains a Server Side Request Forgery (SSRF) vulnerability. The CVE-2021-267166.1Modules/input/Views/schedule.php in Emoncms through 10.2.7 allows XSS via the node parameter.CVE-2021-267177.5An issue was discovered in Sangoma Asterisk 16.x before 16.16.1, 17.x before 17.9.2, and 18.x before 18.2.1 and Certified Asterisk before 16 CVE-2021-267185.5KIS for macOS in some use cases was vulnerable to AV bypass that potentially allowed an attacker to disable anti-virus protection.CVE-2021-267196.5A directory traversal issue was discovered in Gradle gradle-enterprise-test-distribution-agent before 1.3.2, test-distribution-gradle-plugin