GHSA-mhwj-73qx-jqxm: @theecryptochad/merge guard @theecryptochad/merge-guard Has Prototype Pollution Vulnerability
HIGHGHSA-mhwj-73qx-jqxm is a HIGH (CVSS 7.5) @theecryptochad/merge-guard has prototype pollution vulnerability (CWE-1321: Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')) affecting @theecryptochad/merge guard libraries in the npm ecosystem. The issue involves @theecryptochad/merge-guard has prototype pollution in its deepmerge() function. Remediation is available by upgrading affected packages to version 1.0.1.
GHSA-mhwj-73qx-jqxm at a Glance
Security Impact
CVSS: 7.5
The security impact metrics below are parsed directly from the CVSS v3.1 vector string (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N).
How to Fix GHSA-mhwj-73qx-jqxm
To remediate this vulnerability, upgrade all affected @theecryptochad/merge guard dependencies to a patched release. Both direct and transitive dependencies should be checked, as frameworks or security libraries may pull in vulnerable versions transitively.
npm install @theecryptochad/merge-guard@1.0.1Run the following command in your project directory to verify that all resolved dependencies use the patched release:
npm ls @theecryptochad/merge-guardHow to Check if You Are Affected
To determine whether your Node.js application is affected by GHSA-mhwj-73qx-jqxm, inspect your project dependencies using npm:
npm ls @theecryptochad/merge-guardAnalyze the terminal output to locate any version of @theecryptochad/merge guard in your dependency tree. If any resolved version matches the vulnerable ranges listed in the table below (for example, versions earlier than 1.0.1), your application is affected.
Note: The npm ls @theecryptochad/merge-guard command inspects dependencies declared in your package.json and lockfile; it does not perform automated runtime dynamic scanning.
Technical Details
Vulnerability Mechanism & Technical Analysis
This vulnerability is classified under CWE-1321: Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution'), where the product receives input from an upstream component that specifies attributes that are to be initialized or updated in an object, but it does not properly control modifications of attributes of the object prototype. In @theecryptochad/merge guard, software state validation or input boundaries are circumvented during processing. Review the official source advisory statement below for specific affected components, classes, and reproduction details.
Source Advisory Statement
GHSA-mhwj-73qx-jqxm Affected @theecryptochad/merge guard Versions
1 component(s)| Product / Package | Ecosystem | Affected Versions | Fixed Version |
|---|---|---|---|
|
@theecryptochad/merge-guard
|
npm |
< 1.0.1
|
1.0.1
|
References
Frequently Asked Questions
What is GHSA-mhwj-73qx-jqxm?
Which @theecryptochad/merge guard versions are affected?
What version fixes GHSA-mhwj-73qx-jqxm?
Is @theecryptochad/merge-guard affected?
What is the CVSS score of GHSA-mhwj-73qx-jqxm?
What CWE is associated with GHSA-mhwj-73qx-jqxm?
How can I check npm dependencies for GHSA-mhwj-73qx-jqxm?
Machine-readable OSV JSON
OSV v1.5 Schema
{
"schema_version" : "1.4.0",
"id" : "GHSA-mhwj-73qx-jqxm",
"modified" : "2026-05-11T16:10:12Z",
"published" : "2026-05-11T16:10:12Z",
"aliases" : [ ],
"summary" : "@theecryptochad/merge-guard has Prototype Pollution in its deepMerge() function",
"details" : "## Summary\n\n`@theecryptochad/merge-guard` versions prior to 1.0.1 are vulnerable to Prototype Pollution via the `deepMerge()` function. An attacker who controls the source object can inject `__proto__` keys that mutate `Object.prototype`, affecting all objects in the Node.js runtime.\n\n## Details\n\nThe `deepMerge()` function recursively merges two objects without sanitizing reserved property keys (`__proto__`, `constructor`, `prototype`). When a source object contains a `__proto__` key, its value is assigned to `target.__proto__`, which JavaScript engines interpret as a write to `Object.prototype`.\n\n## Proof of Concept\n\n```js\nconst { deepMerge } = require('@theecryptochad/merge-guard');\nconst payload = JSON.parse('{\"__proto__\":{\"isAdmin\":true}}');\ndeepMerge({}, payload);\nconsole.log({}.isAdmin); // true — Object.prototype is polluted\n```\n\n## Impact\n\nAny application using `deepMerge()` with untrusted input (e.g. user-supplied JSON from HTTP requests, WebSocket messages, or config files) is vulnerable. An attacker can inject arbitrary properties onto `Object.prototype`, enabling privilege escalation, application logic bypass, and property injection.\n\n## Remediation\n\nUpgrade to `@theecryptochad/merge-guard >= 1.0.1`, which adds an explicit blocklist:\n\n```js\nconst BLOCKED = new Set(['__proto__', 'constructor', 'prototype']);\nif (BLOCKED.has(key)) continue;\n```\n\n## References\n- [CWE-1321: Improper Neutralization of Special Elements in Object Keys](https://cwe.mitre.org/data/definitions/1321.html)\n- [OWASP: Prototype Pollution](https://owasp.org/www-community/attacks/Prototype_Pollution)\n- [Fix commit](https://github.com/TheeCryptoChad/merge-guard/releases/tag/v1.0.1)",
"severity" : [ {
"type" : "CVSS_V3",
"score" : "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N"
} ],
"affected" : [ {
"package" : {
"ecosystem" : "npm",
"name" : "@theecryptochad/merge-guard"
},
"ranges" : [ {
"type" : "ECOSYSTEM",
"events" : [ {
"introduced" : "0"
}, {
"fixed" : "1.0.1"
} ]
} ]
} ],
"references" : [ {
"type" : "WEB",
"url" : "https://github.com/TheeCryptoChad/merge-guard/security/advisories/GHSA-mhwj-73qx-jqxm"
}, {
"type" : "WEB",
"url" : "https://github.com/TheeCryptoChad/merge-guard/commit/25e4b4f2618578a656ef3cb4946a1b475f736736"
}, {
"type" : "PACKAGE",
"url" : "https://github.com/TheeCryptoChad/merge-guard"
} ],
"database_specific" : {
"cwe_ids" : [ "CWE-1321" ],
"severity" : "HIGH",
"github_reviewed" : true,
"github_reviewed_at" : "2026-05-11T16:10:12Z",
"nvd_published_at" : null
}
}