{"id":"UBUNTU-CVE-2018-16469","details":"The merge.recursive function in the merge package \u003c1.2.1 can be tricked into adding or modifying properties of the Object prototype. These properties will be present on all objects allowing for a denial of service attack.","modified":"2025-10-24T04:47:11Z","published":"2018-10-30T21:29:00Z","upstream":["CVE-2018-16469"],"references":[{"type":"REPORT","url":"https://ubuntu.com/security/CVE-2018-16469"},{"type":"REPORT","url":"https://hackerone.com/reports/381194"},{"type":"REPORT","url":"https://www.npmjs.com/advisories/722"},{"type":"REPORT","url":"https://www.cve.org/CVERecord?id=CVE-2018-16469"}],"affected":[{"package":{"name":"node-merge","ecosystem":"Ubuntu:16.04:LTS","purl":"pkg:deb/ubuntu/node-merge@1.2.0-2?arch=source&distro=xenial"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.2.0-1","1.2.0-2"],"ecosystem_specific":{"binaries":[{"binary_name":"libjs-merge","binary_version":"1.2.0-2"},{"binary_name":"node-merge","binary_version":"1.2.0-2"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2018/UBUNTU-CVE-2018-16469.json"}},{"package":{"name":"node-merge","ecosystem":"Ubuntu:18.04:LTS","purl":"pkg:deb/ubuntu/node-merge@1.2.0-2?arch=source&distro=bionic"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.2.0-2"],"ecosystem_specific":{"binaries":[{"binary_name":"libjs-merge","binary_version":"1.2.0-2"},{"binary_name":"node-merge","binary_version":"1.2.0-2"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2018/UBUNTU-CVE-2018-16469.json"}},{"package":{"name":"node-merge","ecosystem":"Ubuntu:20.04:LTS","purl":"pkg:deb/ubuntu/node-merge@1.2.0-2?arch=source&distro=focal"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.2.0-2"],"ecosystem_specific":{"binaries":[{"binary_name":"libjs-merge","binary_version":"1.2.0-2"},{"binary_name":"node-merge","binary_version":"1.2.0-2"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2018/UBUNTU-CVE-2018-16469.json"}},{"package":{"name":"node-merge","ecosystem":"Ubuntu:22.04:LTS","purl":"pkg:deb/ubuntu/node-merge@2.1.1+ds-2?arch=source&distro=jammy"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.1.0+ds-3","2.1.1+ds-2"],"ecosystem_specific":{"binaries":[{"binary_name":"libjs-merge","binary_version":"2.1.1+ds-2"},{"binary_version":"2.1.1+ds-2","binary_name":"node-merge"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2018/UBUNTU-CVE-2018-16469.json"}}],"schema_version":"1.7.3","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"type":"Ubuntu","score":"low"}]}