PT-2021-11555 · Merge · Merge

Published 2021-02-18 · Updated 2026-06-01 · CVE-2020-28499

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions: merge versions prior to 2.1.1

Description: The issue concerns Prototype Pollution via the recursiveMerge function. This affects the merge package, potentially allowing for malicious modifications to the prototype.

Recommendations: For versions prior to 2.1.1, update to version 2.1.1 or later to resolve the issue. As a temporary workaround, consider restricting the use of the recursiveMerge function until a patch is applied.

Fix

Weakness Enumeration

CWE-915

Related Identifiers

CVE-2020-28499

GHSA-7WPW-2HJM-89GP

SNYK-JAVA-ORGWEBJARSNPM-1071049

SNYK-JS-MERGE-1042987

Affected Products

Merge

References · 12

• https://osv.dev/vulnerability/GHSA-7wpw-2hjm-89gp · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-28499 · Security Note
• https://osv.dev/vulnerability/ROOT-APP-NPM-CVE-2020-28499 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-28499 · Vendor Advisory
• https://github.com/yeikos/js.merge/blob/56ca75b2dd0f2820f1e08a49f62f04bbfb8c5f8f/src/index.ts#L64 · Note
• https://github.com/yeikos/js.merge/blob/master/src/index.ts#L64 · Note
• https://github.com/yeikos/js.merge/commit/7b0ddc2701d813f2ba289b32d6a4b9d4cc235fb4 · Note
• https://github.com/yeikos/js.merge/blob/master/src/index.ts%23L64 · Note
• https://t.me/cibsecurity/23803 · Telegram Post
• https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1071049 · Note
• https://vuldb.com/?id.170146 · Note
• https://snyk.io/vuln/SNYK-JS-MERGE-1042987 · Note