CVE-2026-93753 Overview
CVE-2026-93753 is a prototype poisoning vulnerability in the deepmerge JavaScript library through version 4.3.1. The flaw resides in the mergeObject() function, which fails to validate keys written to target objects during merge operations. Attackers can supply crafted source objects containing prototype-manipulating keys such as __proto__ or constructor.prototype. When merged, these keys inject attacker-controlled properties onto Object.prototype. Downstream code that reads properties without own-property checks then inherits attacker-controlled values. The issue is tracked under CWE-1321: Improperly Controlled Modification of Object Prototype Attributes.
Critical Impact
Any Node.js application performing merges on untrusted input with vulnerable versions of deepmerge can suffer integrity compromise across every object instance in the runtime.
Affected Products
- deepmerge npm package versions through 4.3.1
- Node.js applications and libraries that depend on deepmerge for configuration or object merging
- Server-side JavaScript workloads that pass user-controlled JSON into deepmerge operations
Discovery Timeline
- 2026-09-18 - CVE-2026-93753 published to the National Vulnerability Database
- 2026-09-23 - Last updated in NVD database
Technical Details for CVE-2026-93753
Vulnerability Analysis
The deepmerge library recursively combines source and target objects. The vulnerable mergeObject() function iterates keys from the source object and assigns them to the target without filtering dangerous property names. When a source object contains a key such as __proto__, the recursive merge writes into the prototype chain rather than an own property of the target. Every plain object in the JavaScript runtime then inherits the injected property, producing global integrity impact from a single merge call. The vulnerability affects only integrity; confidentiality and availability are not directly compromised, though inherited values frequently enable secondary exploitation such as authentication bypass or logic corruption in downstream code paths.
Root Cause
The root cause is missing key sanitization inside mergeObject() at lines 39-60 of index.js in the deepmerge repository. The function does not exclude __proto__, constructor, or prototype keys before recursive assignment. It also does not use Object.create(null) or Object.hasOwn() guards when copying source properties.
Attack Vector
Exploitation is network-reachable and requires no authentication or user interaction. An attacker submits a JSON payload containing a __proto__ object with attacker-chosen properties to any endpoint that forwards user input into a deepmerge call. After the merge, the injected properties appear on every object accessed without explicit own-property checks. See the VulnCheck advisory and GitHub issue #273 for technical details and proof-of-concept discussion.
Detection Methods for CVE-2026-93753
Indicators of Compromise
- HTTP request bodies or query parameters containing the literal strings __proto__, constructor.prototype, or "prototype": in JSON payloads
- Unexpected properties appearing on Object.prototype at runtime, detectable via Object.getOwnPropertyNames(Object.prototype) diffing
- Application logs showing type errors or unexpected property values in objects that should have been empty
Detection Strategies
- Perform software composition analysis (SCA) across repositories and container images to locate deepmerge versions at or below 4.3.1 in package-lock.json and yarn.lock files
- Instrument runtime with a proxy on Object.prototype to alert when unexpected properties are written during request handling
- Add web application firewall rules that inspect JSON request bodies for prototype-pollution key patterns
Monitoring Recommendations
- Ingest Node.js application logs and reverse-proxy access logs into a centralized data lake and alert on payloads containing prototype-manipulating keys
- Track dependency graphs continuously so newly introduced transitive deepmerge usage is flagged during CI
- Correlate anomalous authentication or authorization decisions with recent merge operations on user-supplied data
How to Mitigate CVE-2026-93753
Immediate Actions Required
- Inventory all direct and transitive dependencies on deepmerge using npm ls deepmerge and equivalent tooling
- Replace vulnerable versions with a patched release or an alternative merge library that rejects prototype keys
- Add input validation at API boundaries to strip __proto__, constructor, and prototype keys from untrusted JSON before it reaches merge logic
- Freeze Object.prototype early in application startup where compatibility permits
Patch Information
At time of publication, monitor the deepmerge GitHub repository and issue #273 for the fixed release. Upgrade to the first version above 4.3.1 that explicitly rejects prototype-manipulating keys. Rebuild and redeploy all container images that bundle the vulnerable package.
Workarounds
- Sanitize incoming objects with a recursive filter that removes __proto__, constructor, and prototype keys before calling deepmerge
- Use Object.create(null) for target objects passed to merge operations so they have no prototype chain to poison
- Switch to a hardened merge implementation such as lodash.merge with prototype-pollution protections or a maintained fork of deepmerge
- Apply Object.freeze(Object.prototype) during application bootstrap after all legitimate prototype extensions are loaded
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
