CVE-2018-3751

CVE-2018-3751 is a critical prototype pollution vulnerability affecting all versions <= 0.3.0 of the umbraengineering merge-recursive Node.js module. An attacker can manipulate the 'utilities' function to modify the Object prototype, allowing them to add or alter properties on all objects. With a CVSS score of 9.8 (Critical), this vulnerability is easily exploitable over the network with low complexity, leading to complete compromise of confidentiality, integrity, and availability. While there is no evidence of active exploitation or public exploit code (Metasploit, Nuclei, ExploitDB), the vulnerability has garnered significant community discussion, indicating awareness within the security community.