GMS-2020-376: Prototype Pollution in merge-objects

September 1, 2020 (updated September 24, 2021)

All versions of merge-objects are vulnerable to Prototype Pollution. ## Recommendation

No fix is available for this vulnerability at this time. It is our recommendation to use an alternative package.

References

github.com/advisories/GHSA-992f-wf4w-x36v
hackerone.com/reports/310706
www.npmjs.com/advisories/716

Code Behaviors & Features

Detect and mitigate GMS-2020-376 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →