npm/ts-deepmerge CVE-2022-25907: critical 9.8, EPSS 1.85%
ts-deepmerge before 2.0.2 vulnerable to Prototype Pollution
Action: Upgrade ts-deepmerge to 2.0.2 or later.
npm i ts-deepmerge@2.0.2Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 2.0.2 | - |
Fixed versions
| 2.0.2 |
Sources
- osv: GHSA-7qqq-gh2f-wq76
- https://nvd.nist.gov/vuln/detail/CVE-2022-25907
- https://github.com/voodoocreation/ts-deepmerge/commit/9be5148773343c57be9de39728d6ead18eddf10b
- https://github.com/voodoocreation/ts-deepmerge
- https://github.com/voodoocreation/ts-deepmerge/releases/tag/2.0.2
- https://security.snyk.io/vuln/SNYK-JS-TSDEEPMERGE-2959975
CVE-2022-25907 · published · modified · JSON