CVE-2020-28499
1 advisory.
npm/merge CVE-2020-28499: high 7.3, EPSS 1.44%
Prototype Pollution in merge
Action: Upgrade merge to 2.1.1 or later.
npm i merge@2.1.1Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 2.1.1 | - |
Fixed versions
| 2.1.1 |
Sources
- osv: GHSA-7wpw-2hjm-89gp
- https://nvd.nist.gov/vuln/detail/CVE-2020-28499
- https://github.com/yeikos/js.merge/commit/7b0ddc2701d813f2ba289b32d6a4b9d4cc235fb4
- https://github.com/yeikos/js.merge/blob/56ca75b2dd0f2820f1e08a49f62f04bbfb8c5f8f/src/index.ts#L64
- https://github.com/yeikos/js.merge/blob/master/src/index.ts#L64
- https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1071049
- https://snyk.io/vuln/SNYK-JS-MERGE-1042987
- https://vuldb.com/?id.170146
CVE-2020-28499 · published · modified · JSON