Magix-Combine-Ex Prototype Pollution Vulnerability

Magix-combine-ex is a JavaScript library used to combine multiple files into a single file. This vulnerability allows attackers to inject properties on Object.prototype via supplying a crafted payload, causing denial of service (DoS) as the minimum consequence. If you're using this library in your project, be aware that it can lead to unexpected behavior and potential security issues.

You're affected if you use A Prototype Pollution vulnerability. Specific version info not stated in the advisory. If you don't recognise this software, you're probably not affected.

To fix this vulnerability, upgrade to magix-combine-ex version 1.2.11 or higher from the npm registry: https://www.npmjs.com/package/magix-combine-ex/v/1.2.11

Immediate mitigations:

• Disable the util-deps.addFileDepend function in your project, as it's not necessary for most use cases.
• Monitor your application logs for suspicious activity.

• github.com
• Third Party Advisory