Skip to content
Threat Feed
Subscribe

Product

Node.js (Applications Utilizing Insecure DeepMerge Logic)

1 brief RSS
medium advisory

Prototype Pollution Vulnerability in Node.js JSON Merge Patch Implementations

A prototype pollution vulnerability, tracked as CVE-2026-3030, allows attackers to inject malicious properties into the global Object.prototype via insecure deep merge functions, potentially leading to privilege escalation.

Node.js web-application-security prototype-pollution nodejs privilege-escalation
1r 1t