AIKIDO-2026-887444

TL;DR

@75lb/deep-merge deep-merges the values of one object into another using a lodash assignWith customiser that recurses into every own property of the source. When the source is produced by JSON.parse, __proto__ is a real own enumerable property, so the customiser merges into it and writes through to Object.prototype. Untrusted input passed into the merge can therefore pollute the global object prototype, corrupting application logic and enabling denial of service or further escalation. The fix adds a guard that refuses to merge into __proto__, constructor, and prototype keys.