critical10.0
CVE-2024-39008
robinweser fast-loops vulnerable to prototype pollution
Impact
robinweser fast-loops v1.1.3 was discovered to contain a prototype pollution via the function `objectMergeDeep`. This vulnerability allows attackers to execute arbitrary code or cause a Denial of Service (DoS) via injecting arbitrary properties.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| npm | fast-loops | < 1.1.4 | 1.1.4 |