AIKIDO-2026-11101

TL;DR

The _.merge utility in @feathersjs/commons recursively merges source objects into a target without filtering dangerous keys. When source data comes from JSON.parse and contains __proto__, constructor, or prototype keys, the merge writes attacker-supplied values onto Object.prototype, polluting the prototype chain for all plain objects in the process. Exploitation requires a downstream plugin or application to pass JSON-parsed, attacker-controlled data into this helper. The fix skips __proto__, constructor, and prototype keys during the merge.