{"action":"No fix published. Pin and monitor.","affected":[{"introduced":"0","last_affected":"1.3.1"}],"component":"@brikcss/merge","cve_ids":["CVE-2026-6594"],"ecosystem":"npm","epss":0.00336,"exploited":false,"fixed_versions":[],"ghsa_id":"GHSA-3jc6-6r48-v6qf","id":"tcs_01M5KEXJQHRYFHW9MNJ8CJ5QXZ","modified_at":"2026-04-23T14:41:23.150521Z","published_at":"2026-04-20T03:34:41Z","references":["https://osv.dev/vulnerability/GHSA-3jc6-6r48-v6qf","https://nvd.nist.gov/vuln/detail/CVE-2026-6594","https://github.com/brikcss/merge","https://github.com/sudo-secure/security-research/blob/main/brikcss-merge/prototype-pollution/PoC.md","https://vuldb.com/submit/791805","https://vuldb.com/vuln/358229","https://vuldb.com/vuln/358229/cti"],"severity":{"label":"high","score":7.3},"sources":[{"source":"osv","source_id":"GHSA-3jc6-6r48-v6qf","url":"https://osv.dev/vulnerability/GHSA-3jc6-6r48-v6qf"}],"summary":"Deep Merge is Vulnerable to Prototype Pollution Through Lack of Sanitization"}