Skip to content
OpenAdvisories

Package · npm

putil-merge

2 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

1 result · Clear filters · Feed

  • High 8.2
    CVE-2021-23470

    Prototype Pollution

    This affects the package putil-merge before 3.8.0. The merge() function does not check the values passed into the argument. An attacker can supply a malicious value by adjusting the value to include the constructor property. Note: This vulnerability derives f…

    putil-merge npm