The deepmerge library through version 4.3.1 contains a prototype pollution vulnerability in its mergeObject() function. This function fails to properly validate keys being written to target objects during merge operations. An attacker can supply malicious source objects that inject attacker-controlled properties into the prototype of the returned object. This results in applications inheriting unintended prototype properties when accessing object properties without own-property checks.

Successful exploitation allows an attacker to modify the prototype of objects returned by deepmerge, causing applications to inherit attacker-controlled properties. This can lead to unexpected behavior, logic errors, or security issues in applications relying on deepmerge for object merging. The CVSS 4.0 score of 8.7 (high severity) reflects the network attack vector, no required privileges or user interaction, and high impact on integrity.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, avoid merging untrusted input with deepmerge or implement strict validation of keys before merging to prevent prototype pollution.