merge is vulnerable to Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')
CWE-1321, CWE-1321