https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-09T05:41:15.601732+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/cnvd-2019-01299 cnvd-2019-01299 2026-10-09T05:41:15.605575+00:00 cnvd-2019-01299 https://cve.radiocsirt.org/vuln/euvd-2026-68131 EUVD-2026-68131 2026-10-09T05:41:15.605609+00:00 EUVD-2026-68131 https://cve.radiocsirt.org/vuln/fkie_cve-2018-16469 fkie_cve-2018-16469 2026-10-09T05:41:15.605623+00:00

The merge.recursive function in the merge package <1.2.1 can be tricked into adding or modifying properties of the Object prototype. These properties will be present on all objects allowing for a denial of service attack.

 https://cve.radiocsirt.org/vuln/ghsa-f9cm-qmx5-m98h GHSA-f9cm-qmx5-m98h — Prototype Pollution in merge 2026-10-09T05:41:15.605653+00:00

Affected: npm: merge

Versions of `merge` before 1.2.1 are vulnerable to prototype pollution. The `merge.recursive` function can be tricked into adding or modifying properties of the Object prototype.

## Recommendation

Update to version 1.2.1 or later.

 https://cve.radiocsirt.org/vuln/gsd-2018-16469 gsd-2018-16469 2026-10-09T05:41:15.605677+00:00 gsd-2018-16469 https://cve.radiocsirt.org/vuln/ubuntu-cve-2018-16469 UBUNTU-CVE-2018-16469 2026-10-09T05:41:15.605689+00:00

Affected: Ubuntu:16.04:LTS: node-merge, Ubuntu:18.04:LTS: node-merge, Ubuntu:20.04:LTS: node-merge, Ubuntu:22.04:LTS: node-merge

The merge.recursive function in the merge package <1.2.1 can be tricked into adding or modifying properties of the Object prototype. These properties will be present on all objects allowing for a denial of service attack.