Security: Prototype pollution risk in recursive object merge

[tuanaiseo]

Problem

deepMerge only blocks the __proto__ key, but still recursively merges attacker-controlled nested objects and uses Object.assign(a, b) on non-object branches. This can allow pollution through constructor.prototype-style payloads or unsafe key propagation when untrusted input reaches merge paths.

Severity: high
File: lib/utils.js

Solution

Harden merge logic by explicitly rejecting __proto__, prototype, and constructor at every depth; avoid Object.assign(a, b) with untrusted objects; and consider replacing with a vetted safe-merge utility that prevents prototype mutation.

Changes

• lib/utils.js (modified)

Testing

• Existing tests pass
• Manual review completed
• No new warnings/errors introduced