CVE-2026-93753 deepmerge through 4.3.1 Prototype Poisoning via mergeObject
Attackers can inject properties into object prototypes via merge operations, potentially leading to code execution or privilege escalation in applications using the library.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-93753?
CVE-2026-93753 is a high-severity vulnerability in TehShrike deepmerge, published on 18 Sep 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
deepmerge through 4.3.1 contains a prototype poisoning vulnerability in the mergeObject() function that fails to properly validate keys being written to target objects. Attackers can supply malicious source objects in merge operations to inject attacker-controlled properties into the returned object's prototype, causing applications to inherit unintended values when accessing properties without own-property checks.
Weakness: CWE-1321
Which versions are affected by CVE-2026-93753?
2 open source packages ship an affected version, including deepmerge.
| Package | Affected | Fixed in |
|---|---|---|
deepmerge npm | From 4.2.0 to 4.3.1 | None |
deepmerge npm | From 4.2.0 to 4.3.1 | None |
Linux distribution packages (1)
golang-github-prometheus-prometheus openSUSE:Tumbleweed | All versions | 3.15.0-2.1 |
How do I fix CVE-2026-93753?
Upgrade to a fixed version.
Is CVE-2026-93753 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-93753 exists.
Sources
Also known as DEBIAN-CVE-2026-93753, GHSA-gcqx-w48m-w2h4, MINI-3hrf-5869-gx4x, MINI-3qcp-6vx6-5xc8, MINI-c3jq-hxm4-v8xr, MINI-cj6w-h26h-g657 and 4 more.