GMS-2020-376: Prototype Pollution in merge-objects

September 1, 2020 (updated September 24, 2021)

All versions of merge-objects are vulnerable to Prototype Pollution. ## Recommendation

No fix is available for this vulnerability at this time. It is our recommendation to use an alternative package.

References

github.com/advisories/GHSA-992f-wf4w-x36v
hackerone.com/reports/310706
www.npmjs.com/advisories/716

Code Behaviors & Features

Detect and mitigate GMS-2020-376 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →