CVE-2021-25953: Putil-Merge Project Putil-Merge

Critical severity, CVSS 9.8. EPSS: 3% chance of exploitation in the next 30 days.

Prototype pollution vulnerability in 'putil-merge' versions1.0.0 through 3.6.6 allows attacker to cause a denial of service and may lead to remote code execution.

Affected products

• Putil-Merge Project Putil-Merge: from 1.0.0, up to and including 3.6.6

Published 2021-07-14. Last modified 2026-06-17.