CVE-2026-93753: deepmerge mergeObject() allows prototype poisoning of returned objects

September 18, 2026 (updated October 27, 2026)

deepmerge through 4.3.1 contains a prototype poisoning vulnerability in the mergeObject() function that fails to properly validate keys being written to target objects. Attackers can supply malicious source objects in merge operations to inject attacker-controlled properties into the returned object’s prototype, causing applications to inherit unintended values when accessing properties without own-property checks.

References

github.com/TehShrike/deepmerge/blob/5b87756a5671635679001cbac72aa42f23472c81/index.js
github.com/TehShrike/deepmerge/issues/273
github.com/advisories/GHSA-gcqx-w48m-w2h4
nvd.nist.gov/vuln/detail/CVE-2026-93753
www.vulncheck.com/advisories/deepmerge-through-4.3.1-prototype-poisoning-via-mergeobject

Code Behaviors & Features

Detect and mitigate CVE-2026-93753 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →