CVE-2018-3753

CVE-2018-3753 is a critical prototype pollution vulnerability affecting all versions of the merge-objects Node.js module up to and including 1.0.0. An attacker can manipulate the utilities function to modify the Object prototype, allowing them to add or alter properties on all objects. With a CVSS score of 9.8 (CRITICAL), this vulnerability is easily exploitable over the network with low attack complexity, potentially leading to complete compromise of confidentiality, integrity, and availability. Despite its severity, there is currently no known active exploitation, public exploit code (Metasploit, Nuclei, ExploitDB), or significant community discussion or media coverage.