CVE-2021-26707

CVE-2021-26707 is a critical prototype pollution vulnerability affecting the 'merge-deep' library (versions prior to 3.0.3) for Node.js, as well as NetApp E-Series Performance Analyzer. This flaw allows an unauthenticated attacker to overwrite or add properties to Object.prototype, which are then inherited by all objects in the program. With a CVSS score of 9.8 (Critical), it poses a significant risk due to its network-based attack vector, low attack complexity, and high impact on confidentiality, integrity, and availability. While no active exploitation, public exploit code (Metasploit, Nuclei, ExploitDB), or significant community discussion has been observed, the high FAUCET Risk Score of 80/100 indicates its potential severity.