CVE-2026-6594: 
JavaScript vulnerability analysis and mitigation

CVE-2026-6594 is a prototype pollution vulnerability in the @brikcss/merge npm package affecting all versions up to and including 1.3.0. The flaw allows remote, unauthenticated attackers to manipulate JavaScript's global Object.prototype by passing specially crafted objects with keys such as __proto__, constructor.prototype, or prototype to the merge function. It was disclosed on April 20, 2026, with the GitHub Advisory (GHSA-3jc6-6r48-v6qf) published the same day. The vendor did not respond to early disclosure contact. The CVSS v3.1 base score is 7.3 (High); the CVSS v4.0 base score is 6.9 (Medium) (GitHub Advisory, VulDB).

The root cause is the absence of input sanitization in the @brikcss/merge deep merge function, which recursively processes source objects without filtering reserved prototype keys (CWE-1321: Prototype Pollution; CWE-94: Code Injection). When an attacker supplies a crafted object — e.g., parsed from JSON.parse('{"__proto__": {"polluted": true}}') — the merge function writes attacker-controlled properties directly onto Object.prototype, affecting every object in the Node.js process. No authentication or user interaction is required; the attack vector is network-accessible wherever user-supplied data reaches the merge function. A public proof-of-concept is available in the researcher's GitHub repository (PoC, GitHub Advisory).

Successful exploitation pollutes Object.prototype globally within the affected Node.js application, meaning all subsequently created objects inherit the injected properties. This can lead to privilege escalation (e.g., injecting isAdmin: true), denial of service by overriding critical object methods, and unpredictable application behavior across the entire runtime. In combination with other vulnerabilities, prototype pollution can facilitate remote code execution. Confidentiality, integrity, and availability are each assessed as low-impact in isolation, but chained exploitation scenarios can significantly amplify the severity (PoC, GitHub Advisory).

A public proof-of-concept is available in the sudo-secure/security-research GitHub repository, demonstrating the vulnerability in @brikcss/merge v1.3.0. However, there is no evidence of active in-the-wild exploitation or threat actor attribution at this time. The EPSS score is approximately 0.044–0.064%, placing it in the lower percentiles for near-term exploitation likelihood. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (GitHub Advisory, VulDB).

1. Identify target: Locate a Node.js application that uses @brikcss/merge version ≤ 1.3.0 and passes user-controlled input (e.g., JSON from an HTTP request body) to the merge() function.
2. Craft malicious payload: Construct a JSON object with a __proto__ key containing the properties to inject, e.g., {"__proto__": {"isAdmin": true}} or {"constructor": {"prototype": {"polluted": true}}}.
3. Deliver payload: Submit the crafted JSON to any application endpoint that deserializes user input and passes it to merge(), such as a REST API accepting JSON bodies.
4. Trigger prototype pollution: The merge() function recursively processes the object without sanitizing the __proto__ key, writing isAdmin: true (or other injected properties) onto Object.prototype.
5. Exploit polluted prototype: Any subsequent object created in the process will inherit the injected properties. Depending on application logic, this may bypass authorization checks (e.g., if (user.isAdmin)), cause denial of service by overriding methods, or serve as a stepping stone for RCE via gadget chains (PoC, GitHub Advisory).

• Network: Inbound HTTP requests containing JSON bodies with keys __proto__, constructor, or prototype at unexpected nesting levels targeting API endpoints of Node.js applications.
• Logs: Application logs showing unexpected property values on plain objects (e.g., isAdmin: true on unauthenticated sessions); errors related to overridden built-in object methods.
• Process Behavior: Node.js process exhibiting unexpected privilege escalation behavior, authorization bypass, or crashes due to overridden Object.prototype methods.
• File System: Presence of @brikcss/merge version ≤ 1.3.0 in node_modules/@brikcss/merge/package.json ("version": "1.3.0" or earlier) (PoC).

The GitHub Advisory notes that all versions ≤ 1.3.1 are affected and lists no patched version, indicating the vendor has not released an official fix as of the advisory date. Organizations should immediately audit their dependency trees for @brikcss/merge and consider replacing it with an actively maintained deep-merge library that sanitizes prototype keys (e.g., lodash.merge with a version that addresses prototype pollution, or deepmerge with appropriate configuration). As a defense-in-depth measure, implement input validation to strip or reject objects containing __proto__, constructor, or prototype keys before they reach any merge function. Using Object.freeze(Object.prototype) in non-production testing environments can help detect pollution attempts (GitHub Advisory, VulDB).

The vulnerability received standard automated coverage across CVE aggregation platforms (CVEFeed, VulDB, RedPacket Security) shortly after disclosure. A Bluesky post from a CVE tracking account noted the advisory. No notable independent researcher commentary or major media coverage has been identified beyond the original PoC publication and automated feeds (VulDB).