AIKIDO-2026-415640

TL;DR

The exported deepMerge helper recursively merges a source object into a target and is used to combine default and user-supplied meta tag configuration. It iterates over the source object's keys without excluding __proto__, constructor, or prototype, so merging an object that carries these keys recurses into and mutates the shared object prototype. An attacker who can influence the merged configuration can pollute Object.prototype, affecting application behavior and enabling denial of service or further exploitation depending on downstream gadgets. The fix skips __proto__, constructor, and prototype keys from the source object during the merge.