https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2021-23397.htmlhttps://patchthecve.com/cve/CVE-2021-23397.htmlWed, 17 Jun 2026 03:38:41 +0000MEDIUM 5.6: All versions of package @ianwalter/merge are vulnerable to Prototype Pollution via the main (merge) function. Maintainer suggests using @generates/merger instead.https://patchthecve.com/cve/CVE-2021-3645.htmlhttps://patchthecve.com/cve/CVE-2021-3645.htmlWed, 17 Jun 2026 04:05:29 +0000CRITICAL 9.8: merge is vulnerable to Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')https://patchthecve.com/cve/CVE-2020-28499.htmlhttps://patchthecve.com/cve/CVE-2020-28499.htmlWed, 17 Jun 2026 03:10:32 +0000HIGH 7.3: All versions of package merge are vulnerable to Prototype Pollution via _recursiveMerge .