CVE-2018-16469CWE-400

The merge.recursive function in the merge package <1.2.1 can be tricked into adding or modifying properties of the Object prototype

published October 30, 2018

CVSS
—
EPSS
2%
Percentile
76.6
In the wild
Unconfirmed
What it is

The merge.recursive function in the merge package <1.2.1 can be tricked into adding or modifying properties of the Object prototype. These properties will be present on all objects allowing for a denial of service attack.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.01678 · 76.6th percentile
Weakness
CWE-400 · Uncontrolled Resource Consumption
Published
2018-10-30T21:00Z
EPSS history
Timeline
  • 30 OCT 21:00Z
    The merge.recursive function in the merge package <1.2.1 can be tricked into adding or modifying properties of the Object prototype
    cvelistv5