deepmerge EUVD-2026-83258

Exploitation requires the consuming application to pass attacker-controlled source objects into deepmerge's merge operation (e.g. merging untrusted JSON request bodies or config into a target), AND to later access object properties without own-property (hasOwnProperty) checks so the polluted prototype value is inherited and used. The flaw is in mergeObject() which fails to filter dangerous keys such as '__proto__'/'constructor'/'prototype'. Limiting factors: this is a library primitive with no standalone exploit - apps that validate/sanitize input, use Object.create(null) targets, or always use own-property checks are not impacted. Affects deepmerge through 4.3.1.

The vendor CVSS 4.0 score of 8.7 (AV:N/AC:L/AT:N/PR:N/UI:N/VI:H) rates this as high-severity, driven entirely by an integrity impact (VC:N/VA:N - no confidentiality or availability effect), which is consistent with CWE-1321 prototype pollution. However, the raw vector overstates real-world risk: prototype poisoning in a merge library is a library-level primitive, not a directly triggerable end-to-end exploit. Actual impact is fully GATED on the consuming application (1) passing attacker-controlled objects into deepmerge and (2) later reading properties without own-property checks (the description itself states this dependency). That makes AC:L/AT:N optimistic - a realistic assessment is AC:H / AT:P. No EPSS score, no CISA KEV listing, and no explicit public exploit code were provided in the input (reported by VulnCheck via GitHub issue #273); exploitation status is therefore 'no public exploit identified at time of analysis.' The severity is thus better read as a widely-reachable-but-conditional weakness rather than a confirmed high-priority remote exploit. Impact when the gadget chain exists ranges from logic corruption/DoS to potential RCE, but the base VI:H is only realized in vulnerable app patterns.

An application uses deepmerge (≤4.3.1) to merge user-submitted JSON (e.g. config, profile, or API request bodies) into a defaults object. An attacker submits a payload containing a '__proto__' or 'constructor.prototype' key, which mergeObject() writes without key validation, polluting Object.prototype so all objects inherit an attacker-controlled property; the app then behaves unexpectedly when reading that property without a hasOwnProperty check. No public PoC was included in the input, though the VulnCheck advisory and GitHub issue #273 document the flaw.