Prototype Pollution

Vulnerability

The merge() function in the putil-merge npm package prior to version 3.8.0 does not properly validate property keys during recursive merge operations. An attacker can supply a malicious object that includes the constructor property to achieve Prototype Pollution. This vulnerability is an incomplete fix of a previous issue (see [1][3]): earlier versions only blocked the __proto__ key but did not filter the constructor key, allowing pollution of Object.prototype via constructor.prototype. Affected versions: all before 3.8.0.

Exploitation

An attacker with the ability to control the source argument passed to merge() — for example, by providing crafted JSON input that is later merged into an object — can trigger the vulnerability. By setting "constructor": {"prototype": {"polluted": "yes"}} in the source object, the recursive merge traverses into constructor.prototype, adding properties to Object.prototype. No authentication or special privileges are required; the attack depends on the application merging untrusted data [2][4].

Impact

Successful exploitation results in Prototype Pollution, which can lead to denial of service (through JavaScript exceptions) or, depending on application logic, remote code execution if the polluted property alters the behavior of subsequently executed code. The attacker can inject arbitrary properties into the global Object.prototype, potentially affecting all objects in the application and enabling further attacks such as property injection or default value overwriting [3].

Mitigation

Upgrade to putil-merge version 3.8.0 or later, which includes a fix that also blocks the constructor key during merge (commit 476d000) [4]. No workaround is available if the package cannot be updated; developers should avoid merging untrusted objects. As of publication, there is no known listing in CISA's Known Exploited Vulnerabilities (KEV) catalog.