A flaw in the @feathersjs/commons _.merge function allows an attacker to inject a __proto__ property into a source object that has been JSON.parsed. During the recursive merge, the __proto__ key resolves to Object.prototype, enabling the attacker to write properties onto the prototype of all plain objects created in the process. This modification persists for the lifetime of the Node process, potentially affecting all plain objects created within that process.

The vulnerability affects the Feathersjs framework, specifically versions 5.0.44 and earlier. Any application that incorporates feathersjs:feathers and uses the @feathersjs/commons _.merge utility to merge JSON data from untrusted sources is potentially impacted. All projects depending on these legacy versions are at risk until a fixed release is applied.

The CVSS score of 3.7 categorizes this issue as low severity, and the EPSS score of <1% indicates that exploitation is unlikely in the wild. It is not listed in the CISA KEV catalog. The attack vector is inferred to be local code executed within the application— input that is parsed and then merged. Because prototype pollution affects all objects in the process, consequences can be far‑reaching if the application later depends on that polluted prototype for newly created objects.