Prototype pollution via unsafe recursive prototype merge

Prototype pollution in Luyuan merge-deep2 allows remote attackers to alter inherited object properties through crafted input to mergeDeep(). When prototype merging is enabled, the function recursively follows an attacker-controlled proto property and copies nested values onto Object.prototype. Exploitation requires a consuming application to pass attacker-controlled objects with the third argument enabled; consequences depend on how inherited properties affect that application.