CVE-2018-3752

CVE-2018-3752 describes a critical prototype pollution vulnerability in all versions of the merge-options Node.js module up to and including 1.0.0. An attacker can manipulate the utilities function to modify the Object prototype, allowing them to add or change properties on all objects, potentially leading to remote code execution or denial of service. With a CVSS score of 9.8 (CRITICAL), this vulnerability is easily exploitable over the network with low attack complexity and no user interaction required, resulting in high impacts to confidentiality, integrity, and availability. While no active exploitation, public exploit code (Metasploit, Nuclei, ExploitDB), or significant community discussion has been observed, the high severity warrants immediate patching.