Object prototype modification via unsafe recursive merge

Prototype pollution in all versions of Eser Ozvataf Sey allows remote attackers to modify inherited object properties via crafted merge input. The deepmerge() function recursively follows a source object's prototype property and copies attacker-controlled values into Object.prototype without rejecting special keys. Reachability requires a consuming application to pass attacker-controlled objects into deepmerge(); successful exploitation changes properties inherited within that Node.js process.